NVIDIA DCGM Exporter Flaw Puts 12,000 Exposed GPUs at Risk

Lava researcher Michael Katchinskiy found more than 2,000 internet-exposed NVIDIA DCGM Exporter instances, together leaking telemetry from over 12,000 GPUs worth about $100 million, Help Net Security reported. An unauthenticated attacker could crash each exporter by flooding a debug endpoint, cutting operators off from GPU visibility in the middle of a workload.

The flaw, CVE-2026-47483, carries a CVSS score of 8.2 and sits in Go's /debug/pprof/ profiling endpoints exposed by DCGM Exporter. "With enough concurrent unauthenticated requests, the exporter could run out of memory and crash, cutting off visibility into GPU health and activity," Katchinskiy wrote. NVIDIA patched it in version 4.8.2 and advises operators to keep the --enable-pprof flag off unless profiling is needed.

The exposure map skewed heavily toward the US, which hosted 44% of exposed GPUs (5,274), ahead of Romania (2,054) and China (1,967). Nearly 300 organizations were affected, with Voltage Park running the largest number of instances. Affected hardware included NVIDIA's Blackwell Ultra B300, H200, H100, and consumer RTX 5090 and 4090 cards.

Beyond the denial-of-service, the exposed instances leaked their own version strings and fleet metadata. "Every host returned metrics over plaintext HTTP, and none required authentication," Katchinskiy noted; exact version strings let attackers match hosts to known vulnerabilities. Lava disclosed the issue to NVIDIA on July 28, 2026.