A vulnerability in the NVIDIA KAI Scheduler allows authenticated users to access sensitive API endpoints without proper authorization, potentially leading to unauthorized information disclosure.

This vulnerability is categorized as CWE-306, where the application fails to perform necessary authentication checks for critical API functions. The CVSS vector indicates that while the attack requires low privileges, it allows an attacker to bypass intended access controls.

The potential for unauthorized information disclosure poses a significant risk to data confidentiality. By accessing restricted API endpoints, an attacker could potentially exfiltrate sensitive system or operational data. Given the CVSS score of 7.7, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized data exposure.

Immediate Action: Update the NVIDIA KAI Scheduler to version 0.13.0 or later to ensure proper authentication controls are enforced.

Proactive Monitoring: Monitor API access logs for anomalous patterns, specifically looking for unauthorized requests originating from user accounts that should not have access to administrative or sensitive endpoints.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to restrict access to sensitive API endpoints by verifying session tokens or IP-based allowlisting until the patch is applied.

Public Exploit Available: No

Organizations utilizing the NVIDIA KAI Scheduler must prioritize the upgrade to version 0.13.0 to remediate this authentication flaw. Failure to apply this patch leaves the system exposed to potential information disclosure attacks by existing users within the environment. Prompt remediation is recommended to maintain the integrity and confidentiality of the platform.