Threat Intelligence Database

NVIDIA FLARE SDK prior to version 2.7.2 contains an improper input validation vulnerability involving path traversal. Exploiting this flaw could allow an attacker with limited privileges to cause information disclosure. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided yet by NVIDIA. There are no known exploits in the wild at this time.

NVIDIA FLARE SDK versions prior to 2.7.2 contain a deserialization vulnerability in the FOBS component. An attacker can send a malicious FOBS-encoded message that triggers deserialization of untrusted data, potentially leading to remote code execution. This vulnerability has a high severity score of 8.8. No official patch or remediation guidance has been provided yet by NVIDIA. There are no known exploits in the wild at this time.

NVIDIA FLARE SDK versions prior to 2.7.2 contain a critical vulnerability (CVE-2026-24178) in the NVFlare Dashboard's user management and authentication system. This flaw allows an unauthenticated attacker to bypass authorization by manipulating a user-controlled key. Exploitation can lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service. The vulnerability has a CVSS score of 9.8, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.