A critical authorization bypass in the NVIDIA NVFlare Dashboard allows unauthenticated attackers to gain full administrative control over the application.

The vulnerability exists in the user management and authentication system, where improper handling of user-controlled keys allows an unauthenticated attacker to bypass authorization. This can lead to privilege escalation, unauthorized data access, and potential remote code execution.

The vulnerability allows for complete compromise of the NVFlare Dashboard, which is critical for managing federated learning workflows. Unauthorized access could result in the exfiltration of sensitive training data, tampering with machine learning models, or the disruption of critical research and development operations. The 9.8 CVSS score highlights the extreme risk to organizational data and system integrity.

Immediate Action: Update the NVIDIA NVFlare Dashboard to version 2.7.2 or later immediately to patch the authentication and authorization logic.

Proactive Monitoring: Review audit logs for unauthorized access attempts or suspicious administrative actions that occurred prior to the patch deployment.

Compensating Controls: Ensure the dashboard is not exposed to the public internet; place the service behind a VPN or robust authentication proxy to add a layer of defense-in-depth.

Public Exploit Available: Unknown.

This is a high-priority vulnerability that requires immediate attention. Organizations running NVFlare Dashboard must apply the 2.7.2 update as soon as possible, as the ability for unauthenticated users to gain administrative privileges presents an unacceptable level of risk to the confidentiality and integrity of federated learning environments.