CVE-2026-24178: NVFlare User Management Vulnerability Leading to Authorization Bypass
Summary
CVE-2026-24178: NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. Affects nvflare versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NVFlare is an open-source framework developed by NVIDIA for federated learning, enabling multiple parties to collaboratively train machine learning models while keeping their data decentralized. The framework includes a dashboard for user management and authentication, which is crucial for maintaining security and access control. However, a vulnerability has been identified in this system that could allow unauthorized access and manipulation of user privileges.
Vulnerability Detail
The vulnerability in NVIDIA NVFlare Dashboard arises from a flaw in the user management and authentication system. An unauthenticated attacker can exploit this weakness to bypass authorization using a user-controlled key. This could lead to severe consequences, including privilege escalation, data tampering, information disclosure, code execution, and denial of service. The vulnerability is particularly critical due to its potential to compromise the integrity and confidentiality of the system, with a CVSS score of 9.8 indicating its severity.
How To Fix
Minimum fixed version
2.7.2
This is the first release that contains the fix.
pip install --upgrade "nvflare==2.7.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the NVFlare Dashboard and implement additional authentication mechanisms until the package can be updated. This may include using firewalls or VPNs to limit access to trusted users only.
Conclusion
The vulnerability identified as CVE-2026-24178 in the NVFlare Dashboard poses significant risks due to its potential for unauthorized access and manipulation. It is crucial to update to the latest version of the package to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for nvflare →
FAQ
CVE-2026-24178 is a vulnerability in the NVIDIA NVFlare Dashboard that allows unauthorized access through an authorization bypass.
Exploitation of this vulnerability can lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the NVFlare package to version 2.7.2 or later using pip install --upgrade nvflare and consider implementing additional security measures in the meantime.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. It provides real-time alerts to help you maintain security.
Related vulnerabilities
Recent vulnerabilities recorded for nvflare.
