Nvidia patches unauthenticated DoS flaw in DCGM Exporter GPU monitoring tool
A high-severity vulnerability in Nvidia’s DCGM Exporter allows remote attackers to crash monitoring services and disrupt AI workloads.
Key points
- Nvidia released a fix for CVE-2026-47483 in May, addressing an unauthenticated resource exhaustion flaw in DCGM Exporter.
- Lava Security researchers found over 2,000 internet-exposed servers with the vulnerability, representing an estimated $100 million in hardware.
- The flaw allows remote attackers to crash the monitoring service, potentially disrupting AI training and inference workloads on the same host.
Nvidia released a patch in May for a high-severity vulnerability in its DCGM Exporter software that allows remote attackers to crash the service. The flaw, assigned CVE-2026-47483 with a CVSS score of 8.2, enables unauthenticated denial-of-service and information disclosure attacks against enterprise AI infrastructure.
Researchers at Lava Security discovered the issue while scanning for exposed instances of the telemetry agent. They found more than 2,000 GPU servers exposing DCGM Exporter directly to the public internet without authentication. These servers reported more than 12,000 unique GPUs, representing an estimated $100 million in hardware value.
Technical details and impact
The vulnerability stems from how unpatched versions of DCGM Exporter handle concurrent requests to its “/debug/pprof/” profiling endpoints. Attackers can send a large number of simultaneous profiling requests to drive memory consumption high enough to exhaust system resources. This resource exhaustion crashes the exporter service, leading to an immediate loss of visibility into GPU health and activity.
Nvidia classifies CVE-2026-47483 as an uncontrolled resource-consumption vulnerability. The company identified DCGM Exporter version 4.8.2 as the updated version that addresses the issue. The exporter collects metrics such as utilization, memory usage, power consumption, and error events, making them available to monitoring systems like Prometheus via HTTP.
Exposure and affected systems
Lava Security reported that about a quarter of the exposed instances had the profiling endpoints associated with the vulnerability active. The immediate consequence of a successful attack is the disruption of monitoring capabilities. However, the impact extends beyond loss of visibility because the exporter shares a host with active GPU workloads.
Michael Katchinskiy, a researcher at Lava Security, noted in a blog post that CPU and memory pressure from the attack could affect AI training or inference processes running alongside the exporter. This means that crashing the monitoring service could indirectly disrupt critical AI operations on the same server.
What should you do?
Organizations using Nvidia DCGM Exporter should verify their current version and update to 4.8.2 or later to mitigate the risk. Administrators should audit their network configurations to ensure that telemetry agents are not exposed directly to the public internet without authentication. Regular scans for exposed profiling endpoints can help identify vulnerable instances before they are targeted by attackers.
What to do and how to stay safe: Nvidia
- Update Nvidia DCGM Exporter to version 4.8.2 or later to address the unauthenticated resource exhaustion vulnerability.
- Audit network configurations to ensure telemetry agents are not exposed directly to the public internet without proper authentication.
- Scan for exposed profiling endpoints such as “/debug/pprof/” to identify vulnerable instances within your infrastructure.
- Monitor system logs for unusual memory consumption or concurrent requests that could indicate an ongoing denial-of-service attack.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-47483 and how severe is it?
CVE-2026-47483 is a high-severity vulnerability with a CVSS score of 8.2 that allows unauthenticated remote attackers to crash the DCGM Exporter service through resource exhaustion.
How many servers were found to be exposed to this vulnerability?
Lava Security researchers found more than 2,000 GPU servers exposing Nvidia DCGM Exporter directly to the public internet without authentication during their scans.
What version of DCGM Exporter fixes this issue?
Nvidia identified DCGM Exporter version 4.8.2 as the updated version that addresses the uncontrolled resource-consumption vulnerability.
