Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or attacker-in-the-middle attacks. A successful exploit of this vulnerability might lead to code execution, data tampering, escalation of privileges, information disclosure, and denial of service.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
Factory SSH keys on your Spark ⚠️ - CVE-2026-24218 8.1: DGX OS clones one image → same host keys everywhere - check machine-id + ssh_host_* unique; fix: new machine-id + ssh-keygen -A - updating doesn't regen keys (@plotarmordev) Four commands and the box is yours alone. https://nvidia.custhelp.com/app/answers/detail/a_id/5835
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | nvidia | dgx_os | - | - | - |
| HW | nvidia | dgx_spark | - | - | - |