22 September , 2026 Initial release (Official)
Preface: When a company builds an AI cluster from scratch, the workflow flows directly from the Infrastructure Controller to Triton:
1. Hardware Provisioning (NICo): The Infrastructure Controller automatically discovers a new rack of servers. It installs the operating system, flashes the latest firmware to the NVIDIA BlueField DPUs, configures secure network isolation, and installs the necessary GPU drivers and Kubernetes layers.
2. Handoff: Once NICo completes this “zero-touch” setup, the server is officially a certified, secure node in the AI cluster.
3. Model Serving (Triton): Software engineers can now deploy Triton Inference Server containers onto those exact GPUs. Triton takes over to efficiently route user requests, manage GPU memory, and run live AI inference (like generating text or recognizing images).
Background: On September 22, 2026, NVIDIA released a security bulletin. I selected two vulnerabilities (CVE-2026-65113 and CVE-2026-65128) for analysis. For details, please see below:
Perspective and Vulnerability Details: Referring to the accompanying infographic, attackers can exploit two distinct execution paths to compromise NICo’s bare-metal and DPU framework:
CVE-2026-65113: Auth Bypass & Algorithm Confusion
• Affected Component: [NICo CORE MICROSERVICES] ➔ API Gateway / Auth
• Architectural Flaws:
1. Static Key Hard-coding: The validation block ignores the kid header property and falls back to a single GLOBAL_PUBLIC_KEY, completely removing the ability to safely rotate compromised tokens.
2. Algorithm Confusion: jwt.decode() does not bind trusted signature algorithms. This permits malicious actors to flip the token header to HS256 (using the system’s public key as the symmetric shared secret) or none, bypassing cryptographic signature verification altogether.
3. Lax Claim Enforcement: The module lacks forced expiration checks (exp). Removing the expiration parameter from a forged token results in a permanently valid credential.
CVE-2026-65128: SQL Injection (SQLi)
• Affected Path: Administrator/API ➔ API Gateway/Auth ➔ Cluster Config Manager ➔ [DATA & SECURITY LAYER] (PostgreSQL DB)
• Architectural Flaw: After parsing parameters (such as the token’s kid), the Cluster Config Manager leverages native Python f-string concatenation to frame database queries. This enables input data to manipulate the SQL statement structure, giving bad actors direct read/write control over system configuration maps or facilitating Remote Code Execution (RCE) on the database backend.
Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5879