# NVIDIA’s AI Data Center Controller Ships with Hard-Coded Credentials > Source: > Published: 2026-09-24 11:53:20+00:00 A hard-coded credential vulnerability in the [NVIDIA Infrastructure Controller](https://github.com/dsx-ai-factory/infra-controller) (NICo) provides unauthenticated remote access to the control plane of large-scale AI data centers. Identified as [CVE-2026-65113](https://www.nvidia.com/en-us/product-security/), the flaw carries a CVSS score of 9.8 and affects versions 0 through 1.9 of the software. The vulnerability vector is defined as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, confirming the potential for full system compromise. NICo functions as a Kubernetes-based control plane, providing bare-metal lifecycle management for AI infrastructure. It is an open-source management tool that automates hardware discovery, firmware validation, DPU provisioning, OS deployment, network isolation, and tenant sanitization. As the central authority for infrastructure orchestration, the controller manages all tenants and rack-scale systems, including the NVIDIA GB200 and GB300. The NICo documentation notes that “NICo delivers zero-touch lifecycle automation for bare-metal systems that secures datacenter infrastructure at its foundation.” When this foundation contains hard-coded credentials, the security model of the entire data center is compromised. The vulnerability is classified as CWE-798, indicating the presence of hard-coded credentials. According to the [NVIDIA security advisory](https://www.nvidia.com/en-us/product-security/), “A successful exploit may lead to escalation of privileges, data tampering, denial of service, and information disclosure.” Despite the high severity score, the current risk profile is measured. The Exploit Prediction Scoring System (EPSS) for this vulnerability is 0.611%, placing it in the 48th percentile. This indicates a relatively low probability of immediate exploitation. This flaw was disclosed as part of a 14-CVE batch in NVIDIA Security Bulletin 5879 on September 22, 2026. The batch included one critical, five high, and eight medium-severity vulnerabilities. Other notable issues in this cluster include CVE-2026-65128, an SQL injection vulnerability with a CVSS score of 8.8, CVE-2026-65114, which involves missing authentication and carries a CVSS score of 8.3, CVE-2026-65121 with a score of 8.2, and CVE-2026-65130 with a score of 8.0. The batch also addressed CVE-2026-65118 and CVE-2026-65129 regarding improper certificate validation, CVE-2026-65125 for external file path control, CVE-2026-65115 and CVE-2026-65112 for uncontrolled resource consumption, CVE-2026-65124 for XML injection, CVE-2026-65126 for improper workflow enforcement, CVE-2026-65117 for hard-coded passwords, and CVE-2026-65127 for uncleared debug information. These findings indicate that the management plane is becoming the primary attack surface for AI infrastructure. The incident shares technical characteristics with the [BlueMoon patch-gap](https://forkast.news/the-patch-gap-is-the-attack-surface-bluemoon-exploit-kit-arms-five-chinese-apts-in-12-days/), which highlighted the risks of treating trust infrastructure as an attack surface. Similarly, the [WordPress CVE-2026-87902](https://forkast.news/wordpress-core-patched-in-hours-attackers-were-already-inside/) demonstrated the same trust-infrastructure pattern, while the [Agent Governance Stack](https://forkast.news/the-agent-governance-stack-is-forming-four-products-two-weeks-one-pattern/) emphasized the complexities of securing agent-native infrastructure. These cases illustrate that as orchestration engines and API-first integrations become more prevalent, the security of the management layer is paramount. As noted by GBHackers, “These vulnerabilities highlight the importance of restricting access to administrative interfaces and isolating management-plane services from untrusted networks.” Because NICo manages all tenants and rack-scale systems, the integrity of the hardware-level security enforced by BlueField DPUs depends on the security of the controller. The controller operates within a zero-trust model, but hard-coded credentials bypass these enforcement boundaries. The DPUs themselves are not controllable by the tenant host OS, making the controller the critical point of failure. Upgrade to version 2.0 of the infrastructure controller to address the vulnerability. Beyond patching, security teams must prioritize the isolation of management-plane services from untrusted networks and conduct thorough audits to identify and remove any default or hard-coded credentials. These steps are essential to maintaining the integrity of the hardware-level security enforced by BlueField DPUs. Infrastructure operators running multi-tenant AI clouds and GPU-as-a-Service providers should treat the management plane as a high-value target requiring strict network segmentation and continuous monitoring.