This article was published on July 31, 2026.
Preface: Unauthenticated polling and profiling requests in monitoring tools can cause a denial of service (DoS) due to uncontrolled resource consumption and missing rate limits. This behavior leaves endpoints vulnerable to resource exhaustion when flooded with concurrent requests
Vulnerability Background: CVE-2026-47483
- The Component: The NVIDIA Data Center GPU Manager (DCGM) Exporter is a Go-based open-source utility designed to gather low-level GPU hardware telemetry (such as power, temperature, and tensor core utilization) from
nv-hostengineand expose it as Prometheus metrics.
- The Default Behavior: Because the exporter is written in Go, it natively supports Go’s runtime profiling tools (
pprof). To facilitate remote debugging, deep memory allocation checks, and CPU performance tracing, these diagnostic endpoints are exposed at/debug/pprof.
- The Security Flaw: In affected versions, the
/debug/pprofendpoints are exposed publicly over the standard HTTP metrics port (9400) by default. This design choice lacks built-in authentication, encryption, or client rate-limiting mechanisms.
- The Exploit Catalyst: Running deep profiling actions (like collecting multi-second CPU or heap memory allocation traces) is highly resource-intensive on the host CPU and memory.
- The Impact: An unauthenticated remote attacker can submit concurrent, continuous profiling requests to a targeting Pod. This forces the Go runtime to undergo uncontrolled resource consumption, leading to extreme memory/CPU exhaustion that triggers a fatal Denial of Service (DoS) and crashes the monitoring daemon.
Vulnerability details: CVE-2026-47483 – NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information disclosure.
Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5857