Vulnerability · Published Apr 28, 2026 · Assigned by nvidia

CVE-2026-24178

Critical 9.8

In plain English

A critical-severity authorization bypass via user-controlled key in FLARE SDK from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	nvflare	2.7.2	GHSA-jqp3-qrgh-4846
PyPI	nvflare	2.7.2	PYSEC-2026-100

Affected products (as reported)

Vendor	Product	Versions
NVIDIA	FLARE SDK	All versions prior to 2.7.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References