High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring

1. Executive summary

CVE-2026-47483 is a high-severity flaw (CVSS 8.2, CWE-770) in NVIDIA DCGM Exporter that lets an unauthenticated attacker exhaust memory and crash the GPU monitoring service by sending concurrent requests to an exposed profiling endpoint. NVIDIA published a fix in DCGM Exporter 4.8.2; the CVE is not in CISA KEV and EPSS sits at 1%, so mass exploitation is not indicated, but the exposure is real: Lava found roughly 2,100 internet-facing DCGM Exporter hosts across about 300 organisations, 44% of the exposed GPUs in the US and 2,054 in Romania. For EMEA financial services the risk is concentrated in AI and ML estates where DCGM Exporter or Prometheus Node Exporter has been placed on a routable interface, which both leaks GPU and host inventory to any scanner and gives an unauthenticated attacker a way to blind GPU telemetry and degrade training or inference workloads. The primary impact is availability and reconnaissance, not code execution or data theft.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28: ICT third-party risk, general principles	Exposed DCGM Exporter and Node Exporter instances were found on customer infrastructure at GPU cloud providers (Voltage Park, Lambda, Northern Data, DigitalOcean), so the exposure sits inside a third-party ICT service relationship	Clients running AI workloads on GPU cloud providers need to establish whether the provider's monitoring plane is internet-reachable and whether the contract obliges the provider to notify on such exposures
DORA Art. 30: key contractual provisions with ICT third-party providers	The same provider-hosted exposures, where the monitoring endpoint is operated by the customer but reachable through provider infrastructure	Contract terms should assign responsibility for network exposure of customer-deployed monitoring agents and set notification duties when a provider discovers one
NIS2 Art. 21(2)(d): supply chain security measures	GPU cloud and neocloud providers are ICT suppliers into the AI estate, and the exposure was found on their customer infrastructure	Entities in scope must be able to evidence supply chain security controls over these providers, including who is responsible for hardening monitoring endpoints

DORA Art. 17, 18, 19 and 24 and NIS2 Art. 23 are not engaged on the facts here: the source describes an exposure and a crash condition, not a confirmed incident that has disrupted a client's services, so the incident management and reporting chain is not triggered by this item alone. UK NIS 2018 duties are not engaged unless the affected operator is an OES or RDSP and an actual incident occurs.

3. Technical analysis & attack chain

DCGM Exporter reads telemetry directly from the GPUs on a host and publishes it over HTTP, typically on port 9400, for Prometheus to scrape. The metrics include GPU model, a unique UUID per GPU, temperature, utilisation, memory usage, power consumption and error events. All of it is served in plaintext with no authentication in the deployments Lava observed.

Confirmed attack chain:

The operator deploys DCGM Exporter on a routable interface, or a container that binds the metrics and debug endpoints to an externally reachable address.
An attacker scans for the exporter, typically by requesting /metrics on port 9400, and receives GPU model, per-GPU UUID, utilisation and error data without authenticating.
Where the deployment also exposes Go's /debug/pprof/ profiling endpoints (about 25% of the hosts Lava observed), the attacker identifies endpoints that hold a request open for a caller-specified duration.
The attacker sends a large number of concurrent unauthenticated requests to those profiling endpoints.
Memory consumption rises until the exporter runs out of memory and crashes, cutting off GPU health and activity visibility.
The CPU and memory pressure can also slow the host and interfere with training or inference workloads running on it, particularly where resource limits are not set.

The vulnerability mechanism is CWE-770, allocation of resources without limits or throttling. The verified reference records the flaw as CWE-770; the source material describes the same behaviour as unbounded memory growth from concurrent requests, so the two descriptions are consistent.

Lava reproduced the crash using NVIDIA's official DCGM Exporter container without modifying it, which means the profiling endpoint is not necessarily an operator misconfiguration. Deployments that expose the exporter on a routable interface can expose /debug/pprof/ as well.

NVIDIA fixed the issue in DCGM Exporter 4.8.2. Operators should upgrade to that version or later. The source gives two dates for the fix: Help Net Security states NVIDIA published a security bulletin on 28 July 2026, while The Register states the fix shipped in September. The verified reference data does not resolve this, so treat the bulletin date as single-sourced and confirm against NVIDIA's own advisory before citing a date internally.

The reconnaissance value extends beyond DCGM Exporter. Lava also found 12,096 public Prometheus Node Exporter hosts exposing server models, operating systems, firmware versions, hostnames, storage paths and networking hardware, including NVIDIA/Mellanox InfiniBand and RoCE adapter models, firmware versions, link state and fabric activity. One endpoint returned enough data to identify a Dell PowerEdge XE9680 running Ubuntu 22.04.5 LTS with its BIOS and adapter firmware. This is inventory disclosure that lets an attacker match a host to known vulnerabilities without touching it.

Confidence caveats. The exposure counts (about 2,100 DCGM Exporter hosts, 12,000 GPU UUIDs, roughly 300 organisations, 12,096 Node Exporter hosts, the country split and the $100 million hardware estimate) all come from Lava's scanning and are single-sourced. The provider list and the statement that providers worked with customers to remediate are also single-sourced to Lava via the two press reports. No independent corroboration is available in the material provided. No exploitation in the wild is reported, and the CVE is not in CISA KEV.

4. Mitigation & containment

P1 within 24 hours

Identify every DCGM Exporter instance in the estate and determine which are reachable from outside the monitoring network. Check for /metrics and /debug/pprof/ responding on port 9400 from an external vantage point.
Block external access to DCGM Exporter, Node Exporter and Prometheus endpoints at the perimeter and at the cloud security group or network policy layer. These services should only be reachable from authorised monitoring infrastructure.
Where DCGM Exporter 4.8.2 or later is not yet deployed and the endpoint cannot be taken off the internet immediately, disable the /debug/pprof/ endpoints or bind the exporter to a non-routable interface as an interim control.
Set memory and CPU resource limits on the exporter container so that a request flood cannot starve co-located training or inference workloads.

P2 within 72 hours

Upgrade DCGM Exporter to 4.8.2 or later on all hosts. Confirm the running version rather than assuming the image tag reflects it.
Review Prometheus Node Exporter deployments for the same exposure pattern and restrict them to the monitoring network. Node Exporter is not affected by CVE-2026-47483 but leaks host, OS, firmware and adapter detail.
Ask GPU cloud and neocloud providers whether any customer-deployed monitoring agent on their infrastructure is internet-reachable, and whether they will notify you if they find one.

P3 within 7 days

Add external attack surface monitoring for port 9400 and for /debug/pprof/ paths so a future misconfiguration is caught before it is scanned.
Review DORA Art. 28 and Art. 30 contract terms with GPU cloud providers to assign responsibility for network exposure of customer-deployed monitoring agents.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The sources describe exposure and a crash condition, not a compromise, and give no hashes, domains, IP addresses or file paths.

Behavioural indicators:

behaviour	where to observe	confidence
Unauthenticated requests to `/metrics` on port 9400 from outside the monitoring network	DCGM Exporter access logs, perimeter and cloud flow logs	high
Concurrent requests to `/debug/pprof/` endpoints with caller-specified durations	DCGM Exporter access logs, reverse proxy logs	high
Exporter process termination consistent with out-of-memory kill	Host kernel logs, container runtime events, exporter restart history	high
Sudden loss of GPU telemetry in Prometheus for a host that was previously reporting	Prometheus scrape failure metrics, alerting gaps	high
External scanning of port 9400 across multiple hosts in a short window	Perimeter and cloud flow logs	medium

These behaviours are single-sourced to Lava's description of the exposure and the reproduction; verify against your own telemetry before building enforcement around them.

6. Detection

The sources give no file hashes, mutexes, registry keys or command-line artefacts, so a YARA rule would have nothing genuine to match on. Detection here is network and log based.

title: Unauthenticated External Access to DCGM Exporter Metrics or Profiling Endpoints
id: 8f2c1a44-7d3e-4b91-9c05-2a6e5f0b1d77
status: experimental
description: Detects external or non-monitoring-network requests to DCGM Exporter metrics and Go pprof profiling endpoints, the exposure pattern associated with CVE-2026-47483.
author: Adverse Trace
date: 2026-10-09
references:

  - https://www.helpnetsecurity.com/2026/10/09/nvidia-dcgm-exporter-vulnerability-cve-2026-47483/
  - https://www.theregister.com/security/2026/10/08/high-severity-nvidia-bug-could-crash-gpu-monitoring-on-exposed-servers/5302077
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|startswith:

      - '/metrics'
      - '/debug/pprof/'
  selection_port:
    dst_port: 9400
  filter_internal:
    src_ip|cidr:

      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_path and selection_port and not filter_internal
falsepositives:

  - Legitimate monitoring scrapers running outside the RFC1918 ranges
  - Load balancer health checks if they target the metrics path
level: medium

A second rule for the crash condition, where host or container telemetry is available:

title: DCGM Exporter Process Killed by OOM Under Request Load
id: 3b7d9e12-5c48-4a06-b1f2-9e0d4c8a6f31
status: experimental
description: Detects out-of-memory termination of the DCGM Exporter process, consistent with resource exhaustion via concurrent unauthenticated requests to profiling endpoints.
author: Adverse Trace
date: 2026-10-09
references:

  - https://www.theregister.com/security/2026/10/08/high-severity-nvidia-bug-could-crash-gpu-monitoring-on-exposed-servers/5302077
logsource:
  product: linux
  service: kernel
detection:
  selection:
    message|contains:

      - 'Out of memory: Killed process'
      - 'oom-kill'
  selection_target:
    message|contains:

      - 'dcgm-exporter'
      - 'nv-hostengine'
  condition: selection and selection_target
falsepositives:

  - Legitimate memory pressure on a host running other large workloads
level: medium

CVE assessment

1 referenced CVE

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-47483	8.2 High	—	1%	NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause un…

7. Sources

Help Net Security, "High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring", https://www.helpnetsecurity.com/2026/10/09/nvidia-dcgm-exporter-vulnerability-cve-2026-47483/, 2026-10-09
The Register, "High-severity Nvidia bug could crash GPU monitoring on exposed servers", https://www.theregister.com/security/2026/10/08/high-severity-nvidia-bug-could-crash-gpu-monitoring-on-exposed-servers/5302077, 2026-10-08
BSI Germany, "[UPDATE] [hoch] Nvidia GPU Display Treiber: Mehrere Schwachstellen", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2247 (separate NVIDIA display driver advisory, not specific to CVE-2026-47483)

8. Adverse Trace position

Adverse Trace assesses CVE-2026-47483 as a high-severity availability and reconnaissance issue rather than an intrusion risk: CVSS 8.2, not in CISA KEV, EPSS 1%, and no exploitation in the wild reported in the material available. The exposure counts and the provider findings are single-sourced to Lava and should be treated as indicative until corroborated. The client impact for EMEA financial services is concentrated in AI and ML estates where DCGM Exporter or Node Exporter has been placed on a routable interface, and the practical consequence is lost GPU telemetry plus possible degradation of training or inference workloads, not data compromise. We will monitor for exploitation reports and for any NVIDIA advisory update that changes the affected version range, and we will reissue this note if the KEV or EPSS position changes. Clients should confirm their DCGM Exporter version and external reachability within 24 hours and report back so we can track estate-wide exposure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.