High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring

Security researchers at Lava disclosed a high-severity bug in NVIDIA's DCGM Exporter, tracked as CVE-2026-47483 and scored 8.2 on CVSS, that allows attackers without any credentials to overwhelm and crash the GPU monitoring service by flooding it with concurrent requests to exposed Go profiling (/debug/pprof/) endpoints bundled with the official container. The researchers scanned the internet and found over 2,000 servers, covering more than 12,000 GPUs (including NVIDIA Blackwell Ultra B300, H200, H100, RTX 5090 and 4090 models) across nearly 300 organizations, publicly exposing metrics without authentication, with customers of cloud providers such as Voltage Park, Lambda, Northern Data and DigitalOcean affected. They also found that Prometheus Node Exporter, often deployed alongside DCGM Exporter, leaked detailed hardware, firmware, OS and network fabric information that could help attackers map out and target infrastructure. NVIDIA has fixed the issue in DCGM Exporter version 4.8.2, where profiling is now opt-in, and recommends disabling the --enable-pprof flag and restricting exporter access to private networks.