What the scans found
Lava Security published the research on 8 October. Across four internet-wide scans run between March and May 2026, it found roughly 2,100 hosts publicly serving metrics from NVIDIA’s DCGM Exporter — the component that reports GPU health, utilisation and temperature into a monitoring stack. Between them those hosts reported more than 12,000 unique GPUs. None required authentication.
The hardware behind the metrics is not hobbyist. Lava counted 312 B200s and 32 B300s, along with H200s and H100s — NVIDIA’s data-centre parts, built for large training and inference jobs. Roughly the other half of the inventory was consumer and workstation silicon, mostly RTX 4090s and 5090s. Lava puts the whole visible fleet at around $100 million of hardware.
Telemetry is not training data, and reading someone’s GPU utilisation curve does not hand over their model. What it does hand over is shape: how many accelerators a company runs, of what kind, how hard they are working and when they go quiet. That is a reconnaissance map, and it was free.
The flaw, and what it actually does
The vulnerability Lava reported is tracked as CVE-2026-47483 and NVIDIA rates it 8.2 on the CVSS scale — high, not critical. It sits in Go’s /debug/pprof profiling endpoints, which the exporter can expose. Concurrent unauthenticated requests to those endpoints cause what NVIDIA’s advisory calls uncontrolled resource consumption: the exporter’s memory is exhausted and the process falls over, taking GPU monitoring with it. The same pressure on CPU and memory can slow whatever training or inference work shares the host.
It is worth being precise about the ceiling here. Crashing the exporter does not stop the GPU workload, and it does not give an attacker the model or the data. It blinds the operator — which matters most at exactly the moment something else is going wrong.
Lava says it first suspected an operator misconfiguration, then reproduced the behaviour using NVIDIA’s own official container image.
The fix is a version bump and a closed port
NVIDIA fixed the flaw in DCGM Exporter 4.8.2; operators on anything older should upgrade. Lava’s second recommendation costs nothing: leave the profiling endpoint off unless you are actually profiling. In current versions --enable-pprof is opt-in rather than exposed by default, so a correctly configured recent deployment is not reachable this way.
The broader instruction is older than the bug. The exporter’s port is not a public interface, and 2,100 operators had it facing the open internet over plain HTTP with nothing in front of it. That is a deployment default problem, not an NVIDIA code problem, and no patch closes it.
What to watch
Lava’s work demonstrates an attack path; it does not claim any of the organisations it found were attacked, or that any model data was taken. The number worth re-checking is whether that 2,100 falls. The scans ran between March and May, NVIDIA’s advisory came in July and the research went public this month, so the next independent sweep is the one that shows whether disclosure moved anything — or whether a monitoring port that nobody thinks of as an attack surface stays open because nobody owns it.
