CVE-2026-24178 is an authorization bypass vulnerability in the NVIDIA FLARE SDK's NVFlare Dashboard user management and authentication system. An unauthenticated attacker can leverage a user-controlled key to bypass authorization controls. This vulnerability affects all versions prior to 2.7.2. The impact includes potential privilege escalation, data tampering, information disclosure, code execution, and denial of service. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by NVIDIA as of the data provided.

Successful exploitation allows an unauthenticated attacker to bypass authorization mechanisms, leading to critical impacts such as privilege escalation, unauthorized data modification, sensitive information disclosure, arbitrary code execution, and denial of service conditions within the affected NVIDIA FLARE SDK environment.

Patch status is not yet confirmed — check the NVIDIA vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the NVFlare Dashboard and monitor for suspicious activity related to user management. Avoid exposing the dashboard to untrusted networks. Follow NVIDIA's future advisories for updates on patches or mitigations.