CVE-2026-24178

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24178 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24178 Source advisory: OSV:GHSA-JQP3-QRGH-4846...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24178 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24178 Source advisory: GHSA-JQP3-QRGH-4846...

GHSA-JQP3-QRGH-4846 NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

Deserialization of Untrusted Data

Overview nvflare is a Federated Learning Application Runtime Environment Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the FOBS process. An attacker can achieve arbitrary code execution by sending a specially crafted FOBS-encoded message containing...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24186 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24186 Source advisory: SNYK:PYTHON-NVFLARE-16318746...

Authorization Bypass Through User-Controlled Key

Overview nvflare is a Federated Learning Application Runtime Environment Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the user management and authentication process. An attacker can gain unauthorized access, escalate privileges, tamper...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24178 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24178 Source advisory: SNYK:PYTHON-NVFLARE-16318747...

Improper Input Validation

Overview nvflare is a Federated Learning Application Runtime Environment Affected versions of this package are vulnerable to Improper Input Validation via the path traversal process. An attacker can access sensitive information by submitting crafted input that is not properly validated. Remediati...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24204 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24204 Source advisory: SNYK:PYTHON-NVFLARE-16318745...

PYSEC-2026-100

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24178 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24178 Source advisory: OSV:PYSEC-2026-100...

PYSEC-2026-100

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24204 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24204 Source advisory: MEND:CVE-2026-24204...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24186 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24186 Source advisory: MEND:CVE-2026-24186...

CVE-2026-24178

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

CVE-2026-24178

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

fl-manager-components-formatters-pillow (0.1.0), fl-manager-components-preprocessors-torchvision (0.1.0) +8 more potentially affected by CVE-2026-24178 via nvflare (>=2.2.0, <=2.7.1)

nvflare PYPI version =2.2.0, =0.1.0, =0.2.0, =3.1.27, =3.1.27, =3.1.31 Source cves: CVE-2026-24178 Source advisory: MEND:CVE-2026-24178...

CVE-2026-24178

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information...

CVE-2026-24178

NVIDIA NVFlare Dashboard (security bulletin for NVIDIA FLARE SDK) lists CVE-2026-24178 as a critical vulnerability in the user management and authentication system. An unauthenticated attacker may bypass authorization via a user-controlled key, with potential impacts including privilege escalatio...