H3-2026-1064¶
NVIDIA AIStore Force Join Missing Authorization Vulnerability
| Category | VULNERABILITY |
| Base Score | 10.0 |
Description¶
NVIDIA AIStore does not verify that force join prepare and commit requests to the daeForceJoin handler originate from the current cluster primary or arrive over the intra-control network. The cluster membership logic accepts attacker-supplied Smap, BMD, RMD, and Config metadata on the public control endpoint without confirming the sender is a trusted primary node. Remote attackers can reach a proxy or target node's control endpoint and submit a crafted force join request containing arbitrary cluster metadata. The flaw is a missing authorization check (CWE-862) in the prepare and commit phases of the force join workflow. Exploitation requires only network access to an AIStore proxy or target control endpoint.
Impact¶
Successful exploitation lets remote attackers inject arbitrary cluster metadata and redirect the primary node to an attacker-controlled URL. This can disable cluster-wide access controls and hand full administrative control of all nodes and data to the attacker. The resulting cluster takeover enables persistence, data exfiltration, and lateral movement across connected infrastructure. Organizations running AIStore for AI training data or model storage face severe data integrity and confidentiality risk.