{"resourceId":"vulnerability-lookup-pr-448-csaf-feeders-nvidia-no-provider-metadata-20260702","versions":[{"version":"external-f0dc9e170748189aed0383944336a91c975e6ec8f50eff00e442686709dae1f8","resource":{"id":"vulnerability-lookup-pr-448-csaf-feeders-nvidia-no-provider-metadata-20260702","title":"Vulnerability-Lookup CSAF feeder audit: NVIDIA among 5 vendors publishing CSAF without consumable provider metadata, needing custom feeders","organization":"Vulnerability-Lookup project (CIRCL open-source)","sector":"Open-source security tooling","geography":"Global (Luxembourg-based project)","publishedAt":"2026-07-02T08:12:57Z (opened); merged 2026-07-02T11:39:41Z","publicationDate":"2026-07-02","eventDate":"2026-07-02","sourceName":"GitHub — vulnerability-lookup/vulnerability-lookup","sourceLabel":"Open-source project pull request (audit notes)","sourceUrl":"https://github.com/vulnerability-lookup/vulnerability-lookup/pull/448","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","governance-procurement"],"finding":"A July 2, 2026 pull request to the open-source Vulnerability-Lookup platform began as an AI-generated batch of 43 CSAF feeders; reviewers found most guessed metadata URLs were dead, audited every source and kept 7 that actually deliver documents. Among dropped vendors, it lists 5, including NVIDIA, that publish CSAF without consumable provider metadata and therefore need custom feeders rather than the generic CSAF importer. It also notes about 18 vendors publish no public CSAF at all.","sledRelevance":"Why now: NVIDIA moved bulletins to GitHub-only CSAF on Oct 1, 2026. This audit shows NVIDIA's CSAF is not discoverable through standard provider metadata, so agencies relying on generic CSAF tooling may not ingest NVIDIA advisories automatically.","evidence":"Opened the merged PR via the GitHub API and read the full description. It is an engineering audit by project maintainers, not a formal study; vendor status reflects July 2, 2026.","architectureImplications":"Agencies using CSAF aggregators should confirm NVIDIA is actually ingested, or add a custom GitHub-based fetcher.","governanceImplications":"Do not assume 'publishes CSAF' means 'works with our tool'; test each critical vendor.","securityPrivacyImplications":"A silent ingestion gap for GPU drivers and AI software could delay patching.","caveats":"Status as of July 2026; NVIDIA may have added provider metadata since. Not rechecked tonight against a provider-metadata.json endpoint.","streamIds":["nvidia"],"roles":{"sales":"This open-source audit gives a concrete reason to check NVIDIA advisory ingestion: generic CSAF tools could not consume NVIDIA's feed in July because provider metadata was missing. With NVIDIA now GitHub-only, that matters more. We can offer a quick test of whether a customer's vulnerability tool actually picks up NVIDIA bulletins. We should not claim NVIDIA's CSAF is still broken; the audit is three months old and we did not retest it.","engineering":"Engineering implication: generic CSAF discovery may skip NVIDIA, so build or enable a feeder that reads NVIDIA/product-security directly and validates SHA-256 files. Prerequisites are knowing how your scanner or aggregator discovers CSAF sources. Constraint: status could have changed since July. Proof of value: run your CSAF tooling against NVIDIA's repository and confirm bulletins 5891 and 5903 are imported with correct product and version data.","delivery":"Delivery work is a vendor-by-vendor ingestion test for critical suppliers, starting with NVIDIA. The vulnerability management owner runs it and documents any custom feeders. Checkpoints are the initial test and a recheck after each tool upgrade. Proposed acceptance criterion: NVIDIA bulletins appear in the tool automatically within 24 hours. Risks are maintaining custom code and assuming success because the vendor advertises CSAF."},"roleDetails":{"sales":{"customerProblem":"Vulnerability tools may not ingest NVIDIA CSAF automatically.","stakeholders":["Vulnerability management owner","CISO","Security tooling vendor"],"discoveryQuestions":["Does your tool import NVIDIA bulletins without manual steps?","How does it discover CSAF providers?"],"valueHypothesis":"Testing ingestion for critical vendors closes silent gaps (interpretation).","potentialEngagement":"A one-day CSAF ingestion test for top vendors, starting with NVIDIA.","unsupportedClaims":["NVIDIA CSAF is still unusable today (not retested)","Any agency has missed a patch"]},"engineering":{"fit":"Applies to teams using CSAF aggregators or scanners.","architectureIntegration":"Custom fetcher for NVIDIA/product-security or tool configuration pointing at the repository.","prerequisites":["Knowledge of tool's CSAF discovery","GitHub access"],"constraints":["Status as of July 2026","Custom feeders need maintenance"],"security":"Validate checksums; alert on ingestion failures.","proofOfValue":["Import bulletins 5891 and 5903 and verify product/version fields"]},"delivery":{"work":"Test advisory ingestion for critical vendors and document custom feeders.","dependencies":["Vulnerability tool","Vendor list"],"ownership":"Vulnerability management owner.","skillsAdoption":"Staff learn CSAF basics and how discovery works.","governanceCheckpoints":["Initial test","Recheck after tool upgrades"],"acceptanceCriteria":["NVIDIA bulletins ingested automatically within 24 hours (proposed)"],"risks":["Custom code upkeep","Assuming CSAF support equals ingestion"]}},"retrievedAt":"2026-10-07T03:03:37Z","enrichedAt":"2026-10-07T03:09:23Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No direct workforce finding; limited relevance.","procurementImplications":"When buying vulnerability management tools, require a demonstration of ingesting named vendors' CSAF, including NVIDIA.","operatingModelImplications":"Advisory ingestion becomes something to test, not assume.","sourceVerification":{"openedUrl":"https://github.com/vulnerability-lookup/vulnerability-lookup/pull/448","referenceExcerpt":"5 publish CSAF without consumable provider metadata (Palo Alto, NVIDIA, OPC Foundation, Oracle, openEuler)","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}