CVE-2026-24218 is a vulnerability in NVIDIA DGX Spark's operating system factory provisioning process. When a base image is cloned to provision multiple systems, identical SSH host keys are duplicated across these systems. This hard-coded cryptographic key reuse (CWE-321) undermines the uniqueness of host identities, enabling host impersonation or man-in-the-middle attacks. The vulnerability has a CVSS v3.1 score of 8.1, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and the affected versions are unspecified beyond '0'.

The vulnerability allows attackers to impersonate legitimate hosts or intercept communications via man-in-the-middle attacks due to shared SSH host keys. Successful exploitation can result in code execution, data tampering, privilege escalation, information disclosure, and denial of service on affected NVIDIA DGX Spark systems. The high CVSS score reflects significant potential impact on system security and data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying cloned base images with identical SSH host keys or manually regenerate unique SSH host keys on each provisioned system to prevent host impersonation risks.