CVE-2026-47483 – NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints.

This article was published on July 31, 2026.

Preface: Unauthenticated polling and profiling requests in monitoring tools can cause a denial of service (DoS) due to uncontrolled resource consumption and missing rate limits. This behavior leaves endpoints vulnerable to resource exhaustion when flooded with concurrent requests

Vulnerability Background: CVE-2026-47483

  • The Component: The NVIDIA Data Center GPU Manager (DCGM) Exporter is a Go-based open-source utility designed to gather low-level GPU hardware telemetry (such as power, temperature, and tensor core utilization) from nv-hostengine and expose it as Prometheus metrics.
  • The Default Behavior: Because the exporter is written in Go, it natively supports Go’s runtime profiling tools (pprof). To facilitate remote debugging, deep memory allocation checks, and CPU performance tracing, these diagnostic endpoints are exposed at /debug/pprof.
  • The Security Flaw: In affected versions, the /debug/pprof endpoints are exposed publicly over the standard HTTP metrics port (9400) by default. This design choice lacks built-in authentication, encryption, or client rate-limiting mechanisms.
  • The Exploit Catalyst: Running deep profiling actions (like collecting multi-second CPU or heap memory allocation traces) is highly resource-intensive on the host CPU and memory.
  • The Impact: An unauthenticated remote attacker can submit concurrent, continuous profiling requests to a targeting Pod. This forces the Go runtime to undergo uncontrolled resource consumption, leading to extreme memory/CPU exhaustion that triggers a fatal Denial of Service (DoS) and crashes the monitoring daemon.

Vulnerability details: CVE-2026-47483 – NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5857

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.