CVE-2026-47483

DCGM Exporter is a helper tool that reports on the health of NVIDIA GPU hardware, often used by companies running GPU-heavy workloads like AI or data processing. This flaw is like leaving a side door unlocked that, if someone keeps banging on it fast enough, can jam the whole building's systems or let them peek at internal notes — no key needed.

This matters to you if you run NVIDIA DCGM Exporter to monitor GPU hardware, whether on-premises or in the cloud. It only becomes a real risk if the exporter's debug endpoints are reachable over a network rather than kept strictly internal and firewalled.

This should be treated as urgent: the debug endpoints are exposed without any login, security researchers have already found thousands of these servers reachable online, and there is currently no patch to close the gap. Even though no confirmed attacks have been reported yet, the combination of open exposure, no authentication, and no fix means you cannot wait — restrict access now rather than waiting for a vendor update.

Confirm exposure by checking whether your DCGM Exporter instances have /debug/pprof endpoints reachable from any untrusted network (internal segments, cloud VPCs, or the public internet — recent scans found over 2,000 exposed instances). There is currently no fixed version from NVIDIA; monitor NVIDIA's product security bulletins for an update. As an immediate workaround, place the exporter behind a firewall or reverse proxy that blocks external access to /debug/* paths, or disable pprof/debug handlers in the exporter configuration if supported. Monitor for unusual CPU/memory spikes or service restarts on hosts running the exporter, which could indicate resource-exhaustion attempts. Once NVIDIA ships a patch, prioritize upgrading internet- or broadly-network-facing instances first, then internal deployments, and re-verify endpoint exposure after the update.

CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:H) reflects high availability impact with low confidentiality impact and no integrity impact, consistent with a resource-exhaustion denial-of-service with possible information disclosure (CWE-770, Allocation of Resources Without Limits or Throttling). No exploit code is publicly known, and no KEV listing or confirmed in-the-wild exploitation has been reported; press coverage is limited to disclosure and passive exposure scanning (2,000+ servers found open). EPSS estimates a low near-term exploitation probability on a flat trend. No vendor patch exists at this time, elevating risk primarily from unmitigated exposure rather than confirmed active attacks.