CVE-2026-24218

NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln/detail/CVE-2026-24218	US Government Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5835	Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2026-24218	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:nvidia:dgx_os:-:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:dgx_spark:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-20 20:16

Updated : 2026-07-23 12:10

NVD link : CVE-2026-24218

Mitre link : CVE-2026-24218

CVE.ORG link : CVE-2026-24218

JSON object : View

Products Affected

nvidia

dgx_os
dgx_spark

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2026-24218", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24218", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-20T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@nvidia.com", "affectedData": [{"vendor": "NVIDIA", "product": "DGX Spark", "versions": [{"status": "affected", "version": "0", "lessThan": "OTA0", "versionType": "custom"}], "platforms": ["NVIDIA DGX OS"], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T20:16:36.620", "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24218", "tags": ["US Government Resource"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5835", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-24218", "tags": ["Third Party Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service."}, {"lang": "es", "value": "NVIDIA DGX OS contiene una vulnerabilidad en el proceso de aprovisionamiento de f\u00e1brica, donde la clonaci\u00f3n de una imagen base provoca que se implementen claves de host SSH id\u00e9nticas en m\u00faltiples sistemas. El intercambio de identificadores criptogr\u00e1ficos en todos los sistemas aprovisionados de manera similar permite la suplantaci\u00f3n de host o ataques de atacante-en-el-medio. Un exploit exitoso de esta vulnerabilidad podr\u00eda conducir a ejecuci\u00f3n de c\u00f3digo, manipulaci\u00f3n de datos, escalada de privilegios, revelaci\u00f3n de informaci\u00f3n y denegaci\u00f3n de servicio."}], "lastModified": "2026-07-23T12:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:dgx_os:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40EF912C-72C4-4758-9157-169CE92B33C5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:dgx_spark:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "76975E53-4E5C-4C6D-85D9-EE2879F960DF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@nvidia.com"}