PT-2026-35753 · Unknown · Nvflare Dashboard

Published 2026-04-28 · Updated 2026-05-10 · CVE-2026-24178

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVFlare Dashboard versions prior to 2.5.0

Description A flaw in the user management and authentication system allows an unauthenticated attacker to bypass authorization using a user-controlled key. This can result in privilege escalation to full administrator levels, arbitrary code execution, data tampering, information disclosure, and denial of service, granting total access to sensitive project data.

Recommendations Update to version 2.5.0.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-24178

GHSA-JQP3-QRGH-4846

PYSEC-2026-100

Affected Products

Nvflare Dashboard

References · 13

• https://nvidia.custhelp.com/app/answers/detail/a_id/5819 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-100 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24178 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24178 · Security Note
• https://osv.dev/vulnerability/GHSA-jqp3-qrgh-4846 · Vendor Advisory
• https://github.com/NVIDIA/NVFlare · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nvflare/PYSEC-2026-100.yaml · Note
• https://twitter.com/lyrie_ai/status/2053416793843106198 · Twitter Post
• https://twitter.com/CVEnew/status/2049227555467600364 · Twitter Post
• https://twitter.com/UpwindMDR/status/2049407342874071245 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053416792924512638 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2049345790892474778 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2049217092973367454 · Twitter Post