NVIDIA NVFlare Dashboard Authorization Bypass Vulnerability Allowing Privilege Escalation and Code Execution

A vulnerability has been identified in the user management and authentication system of the NVIDIA NVFlare Dashboard. This issue allows an unauthenticated attacker to bypass authorization using user-controlled keys. Exploitation of this vulnerability could lead to privilege escalation, data tampering, unauthorized information disclosure, remote code execution, and denial-of-service conditions.

Impact

Successful exploitation allows for authorization bypass, leading to privilege escalation, data tampering, information disclosure, code execution, and denial-of-service.

Remediation

Users are advised to update to NVIDIA NVFlare SDK version 2.7.2 or later. The updated version can be downloaded from the NVIDIA NVFlare GitHub repository.