NVIDIA DCGM Exporter Flaw Exposes GPU Monitoring to Unauthenticated Denial of Service

Lava Security disclosed CVE-2026-47483, a high-severity vulnerability in NVIDIA DCGM Exporter rated CVSS 8.2, that allows unauthenticated attackers to exhaust monitoring-service resources through its pprof profiling interface. Exploitation could crash the exporter and potentially disrupt AI workloads. Researchers identified approximately 2,100 internet-exposed GPU servers across about 300 organizations, with hundreds potentially vulnerable. Their telemetry disclosed roughly 12,000 GPU UUIDs associated with hardware valued at approximately $100 million; the references report no active exploitation.

NVIDIA addressed the vulnerability in DCGM Exporter version 4.8.2 following responsible disclosure. Lava also identified 12,096 publicly accessible Prometheus Node Exporter hosts exposing infrastructure details useful for attacker reconnaissance. Organizations should upgrade affected DCGM Exporter deployments, restrict monitoring endpoints to authorized infrastructure, and review both GPU and host telemetry services for unintended internet exposure.