CVE-2026-65130: NVIDIA Infrastructure Controller OS Command Injection

CVE-2026-65130 is an OS command-injection vulnerability in NVIDIA Infrastructure Controller for Linux, a datacenter infrastructure-management controller, where NVD's own analysis rates it a network-reachable, no-privilege critical (9.8) while NVIDIA's own PSIRT bulletin scores the same flaw lower (8.0 high) under stricter preconditions requiring high attack complexity and already-held high privileges — a scoring gap worth noting before treating this as remotely exploitable by just anyone.

CVE-2026-65130 (CWE-78, OS Command Injection) affects NVIDIA Infrastructure Controller for Linux, part of NVIDIA's datacenter/GPU-cluster infrastructure-management stack, distributed via the NVIDIA/infra-controller GitHub repository. NVD's description states: "NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure" (NVD), affecting versions 0 through 1.9, fixed in 2.0.

NVD assigns a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required. NVIDIA's own PSIRT submission to NVD is recorded as a Secondary metric and scores the same CVE markedly lower, at 8.0 (high), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H — NVIDIA's own assessment requires high attack complexity and the attacker to already hold high privileges, a materially different exploitability picture than NVD's Primary rating. This page uses NVD's Primary 9.8 as the headline score per NVD's own vulnerability-status "Analyzed" determination, while flagging the vendor's own lower, stricter-precondition score here for completeness (NVD CVE record).

NVIDIA's security bulletin 5879 ("NVIDIA Infrastructure Controller - August 2026," updated 2026-09-22) bundles CVE-2026-65130 together with 13 other CVEs disclosed the same day against the same product, spanning hard-coded credentials, SQL injection, missing authentication, improper certificate validation and more; the bulletin confirms CVE-2026-65130's affected range as versions "0 to 1.9" and the fixed version as "2.0," and credits researcher Navtej Kathuria for the finding. NVIDIA directs users to clone or update from the NVIDIA/infra-controller GitHub repository to obtain the fix (NVIDIA Security Bulletin 5879).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.01624 (76.1st percentile) — the highest among this round's batch, though still a low absolute probability (FIRST EPSS). CVE-2026-65130 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Operators running NVIDIA Infrastructure Controller for Linux versions 0 through 1.9 should update to 2.0, which also addresses the other 13 CVEs disclosed in the same bulletin.

• NVIDIA Infrastructure Controller for Linux versions 0 through 1.9 contains an OS command-injection vulnerability that could lead to code execution, data tampering, denial of service and information disclosure; fixed in version 2.0. — NVD
• NVD Primary CVSS v3.1 base score is 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); NVIDIA's own PSIRT submission is recorded as Secondary and scores it 8.0 high (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), requiring high attack complexity and high privileges. — NVD
• NVIDIA Security Bulletin 5879 bundles CVE-2026-65130 with 13 other CVEs against NVIDIA Infrastructure Controller, confirms the 0-to-1.9 affected range and 2.0 fixed version, and credits researcher Navtej Kathuria. — NVIDIA Security Bulletin 5879
• EPSS score is 0.01624 (76.1st percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS