NVIDIA DCGM Exporter Bug Exposes GPU Servers to Resource Exhaustion Attacks
NVIDIA patched CVE-2026-47483 in DCGM Exporter, allowing unauthenticated attackers to exhaust GPU monitoring servers.
NVIDIA patched CVE-2026-47483, a CVSS 8.2 flaw in DCGM Exporter, a Prometheus metrics service widely used on GPU servers and Kubernetes clusters. Unauthenticated requests to exposed Go /debug/pprof routes can exhaust memory and CPU until the exporter stalls or crashes, hiding GPU health data and potentially slowing nearby AI jobs. Lava Security found about 2,100 unauthenticated hosts revealing more than 12,000 GPU UUIDs across roughly 300 organizations; about one quarter also exposed the profiling routes. Researchers reproduced the issue only in a lab and did not attack the public hosts. NVIDIA tells operators to install 4.8.2 or later and leave --enable-pprof disabled.
- CVE-2026-47483 is rated 8.2 (CWE-770) and allows unauthenticated resource exhaustion
- About 2,100 hosts exposed more than 12,000 GPU identifiers across roughly 300 organizations
- Fix is DCGM Exporter 4.8.2 or later; keep --enable-pprof disabled
- Exposed hardware included H100, H200, B200, B300, RTX 4090, and RTX 5090 GPUs
- CVEs
- CVE-2026-47483
- Vendors
- NVIDIA
- Products
- DCGM Exporter
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-47483 | NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption… | 8.2 | <1% |
From the original article
3 min read at cybersecuritynews.com
NVIDIA patched high-severity flaw CVE-2026-47483 in DCGM Exporter that allows unauthenticated remote attackers to exhaust server resources, crash GPU monitoring, and disrupt AI workloads. DCGM Exporter is a common monitoring tool for GPU servers and Kubernetes clusters. It reads details such as GPU model, temperature, memory use, power draw, errors, and workload activity, then serves […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.