CVE-2026-47483
CVSS 8.2 HIGH: nVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker… EPSS 0.3% (25th percentile).
Vulnerabilities & Exploits · Misconfiguration
Lava found thousands of internet-reachable NVIDIA DCGM Exporter instances, and about a quarter exposed the profiling endpoints tied to CVE-2026-47483. Nvidia says version 4.8.2 fixes the issue.
The weakness is in the exporter’s unauthenticated /debug/pprof/ pages: a burst of concurrent requests can drive memory use high enough to crash the service. That drops GPU visibility, and because the exporter runs on the same host as GPU workloads, the resource pressure can also interfere with training or inference jobs while telemetry itself reveals infrastructure details.
For teams treating DCGM Exporter as just a monitoring sidecar, the exposure is broader than a dead dashboard. If the exporter is public and profiling is left on, the problem is both reconnaissance and outage risk on AI infrastructure, not only a vulnerability in the agent.
1 source · Oct 9
CVSS 8.2 HIGH: nVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker… EPSS 0.3% (25th percentile).
CSO Online
Exposed Nvidia GPU monitors can reveal AI infrastructure secrets
Thousands of exposed DCGM Exporter instances leak GPU telemetry, and some also expose profiling endpoints that could let unauthenticated attackers crash the service.
originalPart of the PlainSec briefing for 2026-10-12
Every edition of this story: Nvidia DCGM Exporter leaks telemetry and can crash