CVE-2026-65162 in NVIDIA AIStore: legacy ETL API took Kubernetes security settings from callers

NVIDIA AIStore for Linux has a CVSS 10.0 flaw in its legacy ETL PodSpec initialization API that let a remote attacker supply Kubernetes host-namespace and container-security settings. Versions 0 through 4.9 are affected, with possible code execution, privilege escalation, data tampering and denial of service.

• CVSS 3.1 score is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C
• Affected versions range from 0 through 4.9
• PodSpec fields include hostNetwork, hostPID and privileged
• Fix requires update and disabling the legacy ETL API