CVE-2026-24178

CRITICAL

NVIDIA FLARE SDK < 2.7.2 - Unauthenticated Authorization Bypass via User-Controlled Key

Title source: llm

Description

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.

References (3)

Core 3

Core References

https://nvd.nist.gov/vuln/detail/CVE-2026-24178

https://www.cve.org/CVERecord?id=CVE-2026-24178

https://nvidia.custhelp.com/app/answers/detail/a_id/5819

Scores

CVSS v3 9.8

EPSS 0.0057

EPSS Percentile 42.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-639

Status published

Products (3)

NVIDIA/FLARE SDK All versions prior to 2.7.2

nvidia/nvflare < 2.7.2

pypi/nvflare 0 - 2.7.2PyPI

Published Apr 28, 2026

Tracked Since Apr 29, 2026