PT-2025-26762 · Nvidia · Nvidia Aistore

Andong Chen + 1 · Published 2025-06-24 · Updated 2025-12-15 · CVE-2025-23260

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NVIDIA AIStore versions prior to 2.3.0

Description: The issue is related to a vulnerability in the AIS Operator of NVIDIA AIStore, where a user can gain elevated access to the k8s cluster by using the ServiceAccount attached to the ClusterRole. This could lead to information disclosure. The vulnerability is associated with excessive RBAC privileges, allowing the Service Account to read and list secrets and configmaps, potentially revealing sensitive information.

Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the privileges of the ServiceAccount attached to the ClusterRole to minimize the risk of exploitation.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-23260

Affected Products

Nvidia Aistore

References · 7

• https://nvidia.custhelp.com/app/answers/detail/a_id/5660 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23260 · Security Note
• https://t.me/k8security/1566 · Telegram Post
• https://twitter.com/CVEnew/status/1937569674570399809 · Twitter Post
• https://t.me/cveNotify/145797 · Telegram Post
• https://t.me/cvetracker/26964 · Telegram Post