Hard-Coded Credential Flaw in NVIDIA NICo Opens Unauthenticated Access to AI Data Centers

NVIDIA Infrastructure Controller (NICo) versions 0 through 1.9 contain hard-coded credentials that allow unauthenticated remote access to the control plane of large-scale AI data centers. The vulnerability is tracked as CVE-2026-65113 with a CVSS score of 9.8—critical severity—and could lead to full system compromise.

NICo serves as a Kubernetes-based control plane that automates the lifecycle of bare-metal infrastructure, from hardware discovery, firmware validation, DPU provisioning, OS deployment, and network isolation to tenant sanitization. As the central orchestration authority, the controller manages all tenants and rack-scale systems, including NVIDIA GB200 and GB300. NICo documentation states that the device "delivers touchless lifecycle automation for bare-metal systems that secure data center infrastructure from the ground up." But when that foundation stores hard-coded credentials, the security model of the entire data center is undermined.

The vulnerability is classified as CWE-798 (hard-coded credentials). According to NVIDIA's security advisory, "Successful exploitation may lead to privilege escalation, data tampering, denial of service, and information disclosure." Despite the high score, the current risk profile is measured. The Exploit Prediction Scoring System (EPSS) for this flaw stands at 0.611%, in the 48th percentile—indicating a relatively low probability of immediate exploitation.

The flaw was disclosed in a batch of 14 CVEs in NVIDIA Security Bulletin 5879 dated 22 September 2026. The batch includes one critical vulnerability, five high, and eight medium. Besides CVE-2026-65113, there are CVE-2026-65128 (SQL injection, CVSS 8.8), CVE-2026-65114 (missing authentication, CVSS 8.3), CVE-2026-65121 (CVSS 8.2), and CVE-2026-65130 (CVSS 8.0). These findings confirm that the management layer is now a primary attack surface for AI infrastructure.

The incident has technical similarities to the BlueMoon patch-gap that highlighted the risk of treating trusted infrastructure as an attack surface. A similar pattern appears in CVE-2026-87902 in WordPress and the Agent Governance Stack. As adoption of orchestration engines and API-based integrations grows, management-layer security becomes crucial.

"This vulnerability emphasizes the importance of restricting access to administrative interfaces and isolating management services from untrusted networks," GBHackers noted.

Because NICo manages all tenants and rack-scale systems, the hardware-level security integrity enforced by BlueField DPUs depends on the controller's security. The controller operates on a zero-trust model, but hard-coded credentials breach those enforcement boundaries. The DPU itself cannot be controlled by a tenant's host OS, making the controller a critical point of failure.

The primary remediation step is to upgrade NICo to version 2.0. Beyond patching, security teams should prioritize isolating management services from untrusted networks and conduct a thorough audit to identify and remove default or hard-coded credentials. Infrastructure operators running multi-tenant AI clouds and GPU-as-a-Service providers need to treat the management layer as a high-value target requiring strict network segmentation and continuous monitoring.

For Indonesia, where adoption of AI data centers and cloud-based GPU services is beginning to grow, this flaw is an early warning. Personal data protection regulations (UU PDP) and cybersecurity standards for strategic sectors require operators not only to rely on patches but also to build layered defense architectures. Dependence on foreign components such as NICo reinforces the urgency of software supply chain audits and strengthening domestic incident response teams.

Looking ahead, the question is: will AI infrastructure vendors change the design paradigm by eliminating static credentials from the start, or will we keep patching flaws in an increasingly complex management layer? Without a fundamental shift, next-generation AI data centers risk becoming glass palaces fragile to attack.