NVIDIA AIStore coordinated wave: unauthenticated ETL PodSpec host escape, Promote arbitrary file read, token revocation with no auth, and the dSort/HT job legs¶

Wave in one line: A 2026-10-13T15:32Z coordinated NVIDIA batch (PSAT-2026-5889) publishes seven AIStore advisories — two critical (10.0 and 9.1) — that read as the product's own unauthenticated-control-plane inventory: a legacy ETL Kubernetes PodSpec initialization API that lets a remote caller supply host-namespace and container-security settings (pod-spec injection → node escape), an unauthenticated token-revocation endpoint (anyone can revoke the cluster's tokens), an unauthenticated Promote API that reads any absolute path the process can reach, an unauthenticated ETL management API (read + start/stop any job), a dSort archive-member traversal on extracted archives, and two SSRF legs (dSort external key-map URL, experimental HT backend original URL). Several advisories state "unauthenticated remote attacker" outright — AIStore's JWT/OIDC auth layer is opt-in, and the wave's headline is that the feature-named API families (legacy ETL, Promote, dSort, HT) do not inherit the gate at all.

Signal: AI clusters are engagement infrastructure (training GPU nodes, shared object stores sitting in front of buckets full of model weights and datasets). This joins the wiki's growing AI-infrastructure line — Ray Dashboard (June 10), vLLM/LMDeploy loading boundaries (June 10), the Oct 13 Siemens MLServer/Composer/DeepPavlov tar-slip fold — with the durable rule: in AI storage platforms, the data-processing job APIs (ETL, dSort, promote, scrub) are privileged control planes, and several of them historically run with no auth at all.

Advisory table (fixed reference: NVIDIA bulletins under PSAT-2026-5889; verify current band on the product security page in your engagement window)¶

Why this is an operator page¶

1. "Legacy" and "experimental" are auth-inheritance gaps. Three of the seven legs live in feature families the product labels legacy (ETL PodSpec), experimental (HT backend), or internal job plumbing (Promote, dSort key map). This is the incomplete-fix/router-family rule from the Oct 9 Nginx UI page applied at the feature-lifecycle level: security gates (JWT validation, RBAC) get wired to the main API family; feature-flagged, deprecated, or job-internal route families are registered elsewhere and skip the gate. Sweep rule for any clustered storage/ML platform: enumerate API families from the router registration source or CLI command tree (ds, admin verbs), then probe each family's least-loved sibling (legacy, experimental, internal) unauthenticated before crediting the product's auth story.
2. Pod-spec pass-through is the cloud-native twin of command injection. GHSA-958w's 10.0 is not a parser bug — it is an API that forwards attacker-controlled Kubernetes fields (host namespaces, security context) to the cluster API. The durable audit predicate: anywhere a multi-tenant service constructs Kubernetes objects from caller data, check which fields are whitelisted vs. copied. Proof boundary: in an owned lab cluster, one ETL spec that sets hostPID and reads a marker file from the node proves host-namespace escape; never test against a cluster hosting other tenants.
3. Unauthenticated revocation is the forgotten admin verb. The token-revocation leg (9.1) generalizes far beyond AIStore: every service with a revocation/blocklist/allowlist admin endpoint should be probed unauthenticated for the write verb, exactly as the wiki's Sept 18 supplied-scope rule says to state-change verbs. Revocation-list write access is a self-DoS you can hand an opponent and a tamper channel into trust state. Recon probe: POST a syntactically valid, semantically empty revocation payload from an unauthenticated client against a lab deployment; any non-401 is the finding.
4. Absolute-path arguments on object verbs = file read without "file read" UI. Promote ("move object into bucket") taking a host-absolute source path is the verb-shaped traversal: the file-read primitive hides inside a legitimate storage operation, so per-route "is this a file API?" reviews miss it. Same shape to grep in other daemons: any object/data-management verb whose path parameter is passed to os.Open/os.Rename without a namespace-root prefix check. Proof stays bounded: one synthetic canary file the daemon can read, listed back into a lab bucket, nothing outside the lab host.
5. Job parameters are SSRF ingress. dSort's external key-map URL and the HT backend's original URL are fetched by workers doing batch jobs, not by a URL-preview feature. URL-policy hardening (the July 30 URL-policy page's hop/transport/spelling-variant scope rule) is routinely wired to user-facing import fields only. On any AI/data platform, list every job-config field that names an external endpoint (key maps, transform endpoints, webhooks, datasource URLs) and give each the owned-callback proof — these fetch from inside training clusters, which sit close to model stores and cloud metadata.

Replayable validation boundaries (lab/authorized scope only)¶

1. Unauthenticated family sweep: against an owned AIStore (or any clustered store), from an unauthenticated client hit one harmless verb per feature family: ETL list (GET /v1/etl/autocreate-family read), Promote dry-run with a canary absolute path the daemon owns, dSort dry-run, token-revocation admin endpoint with an empty valid-shaped list, HT backend health. Record the 401-vs-200 table per family — the missing-401 rows are the inventory. Patched/auth-enforced deployment is the negative control on every row.
2. PodSpec field diff: in an owned cluster only, submit a lab ETL spec carrying one benign host-namespace field and compare the created pod's effective spec (kubectl get pod -o json) against the intended template. Field accepted = boundary crossed; stop there, delete the canary job.
3. Archive-member canary: build a dSort input archive with one member named ../canary_marker aimed at a temp sibling; a positive is the marker created outside the extraction root. Dispose of both roots afterward.
4. Callback proof for the SSRF legs: configure an owned listener; supply the callback URL as key-map/original-URL; the finding is the hit from the cluster's egress position, logged with timestamp. Never chain to internal services or cloud metadata beyond a lab-mock.

Adjacent records processed without publication (same 15:3xZ wave)¶

• NVIDIA Megatron-LM ×2 (42rp/65180, 4jq4/65110, high) + DALI ×2 (3rv3/65150, 8cj8/65147, high) + Warp (j89v/67456, medium): memory-safety legs in checkpoint loading/parser paths — the model/checkpoint artifact channel class is already documented (May 6 extraction page, Oct 13 MLServer fold); no new operator axis without a reproducible sink, and these advisories give none. Keep as recon-target evidence that NVIDIA-adjacent AI stacks got a security-batch day the same afternoon.
• Commvault coordinated pack (96p4/77099 critical CVFS input-validation → command execution, 4p62/77096 missing-auth → command execution, g9jj/77090 XXE, 37r8/77094 OOB write, 7j9q/77095, fr5f/77093, 83mj/77100 MediaAgent heap overflow, jxpj/18228 HyperScale path traversal): backup-infrastructure recon-target class (cf. the Oct 13 Siemens RUGGEDCOM credential-cache rule), but every description is vendor boilerplate with no technical detail — tracked, promoted-if-detail lands.
• H3C HDM writable trust anchor + Huawei openUBMC shipped SNMPv3 keys + H3C HDM signature-key file: folded on the Sept 16 hardcoded/update-key page (see its Oct 13 follow-up).
• Wazuh empty-password reserved-guard bypass: folded on the Sept 21 auth-precedence page.
• Hono serveStatic double-decode middleware bypass: folded on the July 30 URL-policy page.
• NLTK WekaClassifier pathsec bypass: folded on the July 31 library/tenant/commerce file-boundaries page per standing NLTK routing rule.
• Parse Server cross-client transactional batch state (jq9m/109954, high): acknowledged-writes-of-others rolled back on any client's batch failure = cross-tenant availability interference + indefinite-open-transaction stall; interesting tenant-isolation leg but no read/escalate primitive — tracked.
• Zoom pack (v64v/53420 Zoom Phone buffer overflow, hqpx/gvvx improper cert validation pair, jr7h/53418 Android custom-URL-scheme auth): client-side/position-based classes already on the Sept 23 desktop page; tracked.
• FreeRDP ~20-advisory pack (109xxx family, incl. credential exposure wg33, NLA downgrade c6qf, smartcard UAF pair, chunked-infinite-loop 26h4): RDP-client attack surface against malicious servers — desktop-client parser class, tracked; the credential-exposure + protocol-downgrade pair is the one worth a lab rerun if a client-side engagement axis needs it.
• NETGEAR R7300/RAX/extender singles (incl. rvxj RAX auth bypass, 4634 session randomness), InstallShield 2025 R2 privilege escalation (g542/4869), AMI Aptio v pack (local), girishsaraf booking-system SQLi trio, SourceCodester-adjacent singles, Froxlor five-leg (stored XSS wj7h, newline injection 5986, reseller authz gap c54j, IDOR c3jc — hosting-panel tenant classes already covered), EspoCRM IDOR/access-control trio, yt-dlp-web-ui argument injection (g8v9 — known wrapper-args class), Apache Fesod UrlImageConverter SSRF-protection gap, H3C/openUBMC PLDM-MCTP parse trust, Kuhn-family vuldb singles: single-endpoint, thin-detail, or class-covered — processed without publication.

Evidence and reporting checklist¶

• State the family and the gate that should have covered it (JWT middleware, RBAC tier) and show the unauthenticated 200 — the finding is auth-inheritance absence, not "an API exists."
• For the PodSpec leg, redact cluster internals; report the accepted field name(s), the effective pod diff, and the node-escape precondition.
• For Promote file read, name the path class (world-readable lab canary), never real host files; never read credentials, keys, or other tenants' objects.
• For revocation, prove with your own disposable token; never revoke real users' sessions on shared deployments.
• Include version band from the vendor bulletin, lab topology (auth enabled/disabled), the 401-vs-200 family table, and patched negative controls.

Sources¶

• NVIDIA product security bulletin directory PSAT-2026-5889
• Individual advisories linked in the table above.
• AIStore auth model context: auth_validation docs (JWT/OIDC layer is opt-in — default deployments historically run unauthenticated; confirm target posture before testing).