NVIDIA KAI Scheduler Flaw: Unauthorized API Access Poses Data Risk

The National Vulnerability Database has disclosed CVE-2026-24177, a high-severity vulnerability (CVSS 7.7) affecting NVIDIA KAI Scheduler. This flaw, categorized as CWE-306 (Missing Authentication for Critical Function), allows an attacker to access API endpoints without proper authorization.

A successful exploit of this vulnerability could lead directly to information disclosure. The lack of authentication on critical API endpoints is a fundamental security breakdown, offering attackers a low-friction path to sensitive data. While specific affected products are not detailed by the National Vulnerability Database, organizations utilizing NVIDIA KAI Scheduler should assume exposure.

This isn’t just a theoretical bug; it’s a clear avenue for attackers to exfiltrate data. The attacker’s calculus is simple: find an unauthenticated endpoint, query it, and dump whatever information comes back. Defenders need to prioritize this. Unauthenticated access is a gift to adversaries, especially when it touches API endpoints that often handle sensitive operational or user data.