Executive brief
NVIDIA DGX OS, the operating system used for high-performance AI computing systems, contains a flaw where multiple installations share the same secret SSH security keys. This allows an attacker to impersonate a trusted server or intercept encrypted communications between users and the system. If exploited, this could lead to unauthorized access, data theft, or full control over the affected AI infrastructure.
Technical details
A vulnerability exists in the NVIDIA DGX OS factory provisioning process due to the use of hard-coded or shared cryptographic keys (CWE-321). When base images are cloned, identical SSH host keys are deployed across multiple systems instead of being uniquely generated. A remote, unauthenticated attacker can exploit this to perform adversary-in-the-middle (AiTM) attacks or host impersonation. Successful exploitation can lead to sensitive information disclosure, session hijacking, and potentially remote code execution or privilege escalation. The attack complexity is rated high as it typically requires the attacker to be positioned to intercept network traffic.
Affected products
- NVIDIA DGX OS
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory