CVE-2026-24177

High

Published: 21 April 2026

Published

21 April 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0003 8.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24177 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly addresses the missing authentication for critical API endpoints in NVIDIA KAI Scheduler by restricting permitted actions without identification or authentication.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to API endpoints, preventing unauthorized information disclosure exploited over the network.

AC-6 Least Privilege partial match

prevent

Limits privileges available to low-privilege attackers (PR:L) to mitigate the impact of unauthorized API access leading to high confidentiality violations.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authentication on exposed API endpoints directly enables remote exploitation of a public-facing application for unauthorized access and information disclosure.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure.

Deeper analysisAI

CVE-2026-24177 is a vulnerability in the NVIDIA KAI Scheduler that enables an attacker to access API endpoints without authorization. This missing authentication for critical functions, classified under CWE-306, could result in information disclosure. The issue received a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and was published on 2026-04-21.

The vulnerability can be exploited over the network by an attacker with low privileges, requiring low complexity and no user interaction. Scope is changed, allowing high-impact confidentiality violations without affecting integrity or availability.

Advisories providing further details and potential mitigations are available from the National Vulnerability Database at https://nvd.nist.gov/vuln/detail/CVE-2026-24177, NVIDIA at https://nvidia.custhelp.com/app/answers/detail/a_id/5818, and CVE.org at https://www.cve.org/CVERecord?id=CVE-2026-24177.