CVE-2026-24218
NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24218?
CVE-2026-24218 is considered a high-severity vulnerability due to its potential to allow host impersonation attacks.
How do I fix CVE-2026-24218?
To fix CVE-2026-24218, ensure unique SSH host keys for each system by configuring the SSH service properly during provisioning.
What systems are affected by CVE-2026-24218?
CVE-2026-24218 affects systems running NVIDIA DGX OS that utilize the factory provisioning process.
What can happen if CVE-2026-24218 is exploited?
If exploited, CVE-2026-24218 can allow an attacker to impersonate a host and potentially intercept or manipulate sensitive communications.
How can I determine if my system is vulnerable to CVE-2026-24218?
You can determine if your system is vulnerable to CVE-2026-24218 by checking if it has identical SSH host keys in a multi-system environment provisioned with the same base image.