{"resourceId":"nvidia-psirt-bulletin-5857-dcgm-exporter-cve-2026-47483-20260728","versions":[{"version":"external-f5401e4d07b5ecc1581545a22f6e5663985a31b06ca4eac3d3753ac7e5ebfed5","resource":{"id":"nvidia-psirt-bulletin-5857-dcgm-exporter-cve-2026-47483-20260728","title":"NVIDIA PSIRT bulletin 5857 (July 2026): CVE-2026-47483 in DCGM Exporter /debug/pprof — CVSS 8.2 High; update DCGM to 4.5.3 and DCGM Exporter to 4.8.2","organization":"NVIDIA PSIRT","sector":"Technology vendor (product security)","geography":"Global","publishedAt":"2026-07-28","publicationDate":"2026-07-28","eventDate":"2026-10-08","sourceName":"NVIDIA product-security GitHub (bulletin 5857)","sourceLabel":"Vendor security bulletin","sourceUrl":"https://raw.githubusercontent.com/NVIDIA/product-security/main/2026/5857/5857.md","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"NVIDIA's July 28, 2026 security bulletin 5857 covers CVE-2026-47483: DCGM Exporter on all platforms has a vulnerability in /debug/pprof endpoints where concurrent unauthenticated profiling requests can cause uncontrolled resource consumption, with impacts of denial of service and information disclosure (CVSS 8.2 High, CWE-770). The updates table lists DCGM affected through 4.5.2 updated to 4.5.3, and DCGM Exporter affected through 4.8.2 updated to 4.8.2. Acknowledgements credit Michael Katchinskiy. Why now: Oct 8 independent research and reporting revived this mid-summer bulletin with large-scale internet exposure evidence; operators who missed July patching have fresh cause to verify.","sledRelevance":"Canonical vendor remediation guidance for the CVE featured in today's exposure reporting. SLED platform teams should pin these versions and not rely on secondary press alone for patch levels.","evidence":"Opened and read the full Markdown bulletin from NVIDIA's product-security repository (raw). Vendor advisory; does not include exposure prevalence.","architectureImplications":"Patch both DCGM and DCGM Exporter where both are deployed; exporter-only bumps may be insufficient if hostengine versions lag.","governanceImplications":"Keep bulletin 5857 in the July–October patch evidence pack for auditors asking why GPU monitoring changes were prioritized.","securityPrivacyImplications":"Vendor confirms DoS and information disclosure impacts for unauthenticated pprof abuse; network exposure remains an operator control outside the bulletin.","caveats":"Bulletin dated July 28, 2026 (revision 1.0.0). The exporter 'updated version' cell lists 4.8.2 while affected range includes 4.8.2—operators should confirm the fixed package digest with NVIDIA support or release notes if ambiguous. Later exporter 4.8.3 release notes mention stronger opt-in pprof controls.","streamIds":["nvidia"],"roles":{"sales":"The PSIRT bulletin is what security committees ask for after reading today's Register and LAVA coverage—authoritative CVE text, CVSS 8.2 and a version table. Bring it to the same meeting as the exposure research and offer a patch-verification engagement that produces evidence against bulletin 5857. Do not imply the bulletin itself proves internet exposure prevalence; it does not. Do not gloss over the exporter version cell that lists 4.8.2 as both affected and updated—verification of the fixed package digest is part of the work.","engineering":"Fit as the version source of truth for remediation: upgrade DCGM to 4.5.3 and DCGM Exporter to the fixed 4.8.2 package, then re-read pprof configuration. Architecture should keep hostengine and exporter versions from skewing across nodes. Prerequisites are a maintenance window, package access and a rollback image. Consider later 4.8.3 notes on stronger opt-in pprof controls after the bulletin baseline. Proof of value: running versions match the bulletin table and the change ticket cites CVE-2026-47483.","delivery":"Delivery is standard vulnerability change management: announce, patch, verify scrape health and file bulletin evidence. Platform operations executes the upgrades; security retains the bulletin and version screenshots for auditors. Checkpoints are pre-change version capture, post-change verification and evidence filed. Proposed acceptance: all production exporters meet or exceed bulletin versions with CVE-2026-47483 referenced in the ticket. Risk: upgrading only Exporter or only DCGM, or closing the ticket without a scrape test."},"roleDetails":{"sales":{"customerProblem":"After public exposure reporting, buyers need the vendor bulletin to authorize and document patching.","stakeholders":["CISO","Patch management","Research computing","Audit/compliance"],"discoveryQuestions":["Are we still on DCGM ≤4.5.2 or Exporter ≤4.8.2?","Where is bulletin evidence stored?","What is the emergency change window?"],"valueHypothesis":"Pairing bulletin 5857 with today's exposure research can unlock emergency change approval (interpretation).","potentialEngagement":"A patch-verification engagement producing version evidence against bulletin 5857.","unsupportedClaims":["That the bulletin documents internet exposure counts","Clarity if 4.8.2 is both affected and fixed without checking digests","Guaranteed workload non-impact during patch"]},"engineering":{"fit":"Mandatory version baseline for DCGM Exporter deployments.","architectureIntegration":"Upgrade DCGM to 4.5.3 and Exporter to the fixed 4.8.2 package; review pprof flags post-upgrade; consider 4.8.3+ for stronger opt-in controls per later release notes.","prerequisites":["Maintenance window","Access to NVIDIA packages/GitHub releases","Rollback image"],"constraints":["July bulletin may be missed in monthly cycles","Ambiguous same-version cell for Exporter 4.8.2","Hostengine vs exporter skew"],"security":"Follow vendor CVSS 8.2 High guidance; still combine with network restriction from independent research.","proofOfValue":["Capture pre/post versions","Verify CVE ID in change record","Test metrics scrape after upgrade"]},"delivery":{"work":"Execute and evidence the 5857 patch across GPU clusters.","dependencies":["Package mirrors","Cluster maintainers","Monitoring stakeholders"],"ownership":"Platform ops patches; security retains bulletin evidence; PIs accept brief metrics gaps.","skillsAdoption":"On-call learns to read PSIRT Markdown version tables.","governanceCheckpoints":["Pre-change version snapshot","Post-change verification","Evidence filed to audit folder"],"acceptanceCriteria":["All prod exporters meet bulletin versions (proposed)","Change ticket cites CVE-2026-47483 / 5857 (proposed)"],"risks":["Partial component upgrade","No digest verification","Closing the ticket without scrape test"]}},"retrievedAt":"2026-10-09T03:19:57Z","enrichedAt":"2026-10-09T03:25:09Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"None directly; patch communications should warn dashboard users of short metric gaps.","procurementImplications":"Managed GPU service contracts should reference current PSIRT bulletins in patch SLAs.","operatingModelImplications":"Ties GPU telemetry stack into the same vulnerability-management cadence as OS and Kubernetes components.","sourceVerification":{"openedUrl":"https://raw.githubusercontent.com/NVIDIA/product-security/main/2026/5857/5857.md","referenceExcerpt":"an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}