Description

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-22T15:17:13.183Z",
  "pubdate": "2026-09-22T15:17:13.183Z",
  "executiveSummary": "The NVIDIA Infrastructure Controller for Linux is susceptible to a SQL injection vulnerability, a critical security flaw that arises when untrusted user input is improperly neutralized before being included in a database query. This vulnerability poses a severe risk to the integrity, availability, and confidentiality of the affected infrastructure management systems.\nAn attacker capable of exploiting this flaw can manipulate backend database queries, potentially leading to unauthorized data extraction, modification of administrative records, or the complete disruption of service through denial-of-service (DoS) conditions. Furthermore, in specific configurations, the injection may be leveraged to achieve arbitrary code execution on the underlying host, facilitating full system compromise.\nThe vulnerability necessitates immediate attention due to the potential for attackers to bypass existing authentication mechanisms and interact directly with the controller's data layer. Given the nature of infrastructure controllers, which often manage sensitive network and hardware configurations, the impact extends beyond simple data theft to potential lateral movement within the data center environment. Organizations utilizing affected NVIDIA Infrastructure Controller versions must evaluate their exposure and prioritize the implementation of recommended security controls to mitigate the risk of remote exploitation.",
  "technicalDetails": "The vulnerability resides within the data processing layers of the NVIDIA Infrastructure Controller, specifically where input vectors originating from management interfaces or API calls are passed to backend SQL database engines without rigorous sanitization or parameterization. This lack of input validation allows an attacker to inject malicious SQL syntax into legitimate query structures.\nThe attack flow begins when an attacker identifies an input parameter—such as a request field, header, or URL parameter—that is subsequently processed by the controller's database abstraction layer. By crafting a payload containing SQL control characters (e.g., single quotes, comment delimiters like '--' or ';'), the attacker can prematurely terminate the intended query and append arbitrary SQL commands.\nThe exploitation mechanism leverages the underlying database permissions of the service account used by the Infrastructure Controller. If the controller operates with elevated database privileges, the attacker may utilize UNION-based injection to exfiltrate database schemas or credentials, or error-based injection to map the database structure. In instances where the database configuration allows administrative commands or file system interaction (e.g., via xp_cmdshell-like functionality or SELECT INTO OUTFILE), an attacker can escalate the injection to remote code execution (RCE) by writing malicious scripts to the file system or executing system-level binaries.\nThe root cause is the failure to employ prepared statements or parameterized queries during the development of the controller's database interaction modules. Instead of treating input as data, the application treats the injected malicious payload as executable code, fundamentally breaking the separation between data and instructions. The vulnerability is persistent across the affected Linux-based deployment, potentially exposed via the controller's network management ports.\nImpacts include, but are not limited to: 1) Information Disclosure: Unauthorized retrieval of sensitive configuration data or user credentials. 2) Data Tampering: Modification or deletion of critical infrastructure logs, policies, or controller settings. 3) Denial of Service: Execution of resource-intensive queries that saturate database connections or lock critical tables. 4) Remote Code Execution: Full system compromise by leveraging the application's environment to execute shell commands with the privileges of the infrastructure service."
}