What happened
NVIDIA AIStore for Linux (versions 0 to 4.9) has a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit can create privileged containers and lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service at the host node level (CWE-250, CVSS 10.0, scope-changed).
Why it matters
AIStore is NVIDIA's storage/data platform for AI/ML pipelines, so this is an AI-infrastructure component at critical severity. A network attacker who can reach the ETL pod-spec API can escape the Kubernetes workload boundary and compromise the underlying node hosting AI data workloads, potentially exposing model weights, datasets, and the data plane that feeds training/inference.
Attack vector
Network attacker supplies crafted Kubernetes host-namespace and container-security settings via the legacy ETL PodSpec initialization API to create a privileged container and compromise the host.
Affected systems
NVIDIA AIStore for Linux, versions 0 to 4.9.
Mitigation
Apply the patched AIStore release from NVIDIA advisory 5889; restrict network reachability of the ETL PodSpec API and harden the K8s PodSpec validation. CISA SSVC as of 2026-10-13: exploitation 'none' but automatable 'yes' and technical impact 'total'.