A hard-coded credential in a random web app is a bad day. A hard-coded credential in the controller that provisions every server, DPU, and tenant network in an AI data center is a different class of problem, because of what the controller is allowed to do.
NICo's own documentation describes it as delivering "zero-touch lifecycle automation for bare-metal systems that secures datacenter infrastructure at its foundation." The architecture is a Kubernetes-based control plane with a REST API, site agents, and Temporal workflows, deployed on the bare-metal cluster it manages. It handles hardware discovery, firmware validation, DPU provisioning through the DOCA Platform Framework, OS deployment, network isolation, and tenant sanitization. It is the single authority that prepares a bare-metal machine to become part of a multi-tenant AI cloud.
Official NVIDIA Product Security page (nvidia.com/en-us/product-security/, captured 2026-09-30): the bulletin listing shows the September 2026 NVIDIA Infrastructure Controller advisory (5879), rated Critical, with CVE-2026-65113 first in the list of fourteen.
That centrality is exactly what makes CVE-2026-65113 dangerous. The flaw allows an unauthenticated remote attacker to bypass authentication using the static credentials; NVIDIA's advisory describes a successful exploit as potentially leading to escalation of privileges, data tampering, denial of service, and information disclosure. Applied to NICo, that is not one server: it is the plane from which an attacker can reach every tenant's bare metal, every DPU, and the network isolation the controller is supposed to enforce. NVIDIA's own security guidance in the same disclosure cycle is blunt about the class: restrict access to administrative interfaces and isolate management-plane services from untrusted networks.
The hard-coded credentials are the headline, but they are not the whole story. CVE-2026-65128 is a SQL injection rated 8.8 that low-privilege attackers can use to reach code execution. CVE-2026-65114 is missing authentication on a critical function, rated 8.3. CVE-2026-65121 is improper authentication enabling privilege escalation, at 8.2. CVE-2026-65130 is OS command injection at 8.0. Add improper certificate validation (7.5 and 6.7), external file/path control, XML injection, workflow-enforcement failures, a separate hard-coded password, uncontrolled resource consumption, and uncleared debug information, and the picture is consistent: a management plane that accumulated authentication and trust-validation weaknesses across its release history, disclosed together because they were only reviewed together.
Official NVIDIA Infra Controller documentation (docs.nvidia.com/infra-controller, captured 2026-09-30): "What is NICo?" — the zero-touch bare-metal lifecycle management controller that the September bulletin's fourteen CVEs address.
The pattern is worth naming: as AI infrastructure consolidated into GPU clouds and large on-prem clusters, the management plane became the crown jewel, and its security did not scale with its privileges. Cloud partners and GPU-as-a-service providers run NICo precisely because it automates provisioning of DPU-equipped racks; that automation is valuable, and it is valuable to an attacker in exactly the same proportion. NVIDIA's documentation lists Vault and external-secrets as part of the reference deployment, which makes the hard-coded credential all the more conspicuous: the surrounding stack attempts to manage secrets properly while the controller itself ships with one baked in.
The direct fix is mechanical: upgrade to NICo version 2.0, or clone the latest release from the project's official GitHub repository. That is the precondition, not the whole answer.
Official NICo source repository (github.com/dsx-ai-factory/infra-controller, captured 2026-09-30): the open-source home of the NVIDIA Infra Controller, moved from the NVIDIA organization on September 4, 2026; version 2.0 is the fixed release for bulletin 5879.
First, treat the management plane as what it is — the most privileged network in the estate. NICo, like other infrastructure controllers, should be reachable only from a dedicated management VLAN or jump-host path for operators, never from tenant networks or the internet. The DPUs it provisions are not controllable by tenant host operating systems, which means the controller is the critical point of failure for the hardware-level security model: if the controller goes, so does the isolation story. Second, audit for credentials before re-trusting the upgrade: scan for hard-coded passwords and default accounts across the controller configuration, and rotate anything that looks inherited. Third, if you are a multi-tenant operator, financial or otherwise — this advisory is aimed squarely at AI-cloud and GPU-as-a-service providers — write the management-plane isolation into your change plan, not just the version bump.
Netics editorial diagram grounded in bulletin 5879 guidance: the management plane before the fix — NICo 0–1.9 reachable from tenant networks with hard-coded credentials — and after — NICo 2.0 on a dedicated management VLAN with a completed credential audit.
This is the same lesson the BlueField-4 scale-in analysis drew from a different direction: when control leaves the host and moves into infrastructure hardware, the control plane becomes the trust boundary, and every operator needs to know exactly what that plane can do. Here the plane can provision every tenant's hardware, and until this advisory it answered to a hard-coded credential. Upgrade, isolate, audit — in that order, and before the next batch of GPU capacity goes online.
Originally published on the Netics blog.