2,100 GPU servers leak telemetry via open port 9400

Researchers at Lava found roughly 2,100 GPU servers exposing unauthenticated DCGM Exporter metrics on port 9400, covering about 12,000 GPU UUIDs across 300 organizations including Nebius, Lambda, Voltage Park and DigitalOcean. The flaw, CVE-2026-47483, is fixed in DCGM Exporter 4.8.2, but patching does not stop the telemetry leak.

• About 2,100 servers and 12,000 GPU UUIDs across 300 organizations are exposed without auth
• CVE-2026-47483 (CVSS 8.2) lets attackers crash the exporter via /debug/pprof
• The fix ships in DCGM Exporter 4.8.2, but patching does not close the metrics leak
• Exposed hardware ranges from Blackwell B300 and H200 nodes to consumer RTX 4090 boxes