CRITICAL9.8

PYSEC-2026-100

Quick fix

PYSEC-2026-100 — nvflare: upgrade to the fixed version with the command below.

pip install --upgrade 'nvflare>=2.7.2'

Details

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/nvflare

Introduced in: 0Fixed in: 2.7.2

Fixpip install --upgrade 'nvflare>=2.7.2'

References

https://nvd.nist.gov/vuln/detail/CVE-2026-24178[ADVISORY]
https://nvidia.custhelp.com/app/answers/detail/a_id/5819[ADVISORY]
https://www.cve.org/CVERecord?id=CVE-2026-24178[ADVISORY]
https://github.com/advisories/GHSA-jqp3-qrgh-4846[ADVISORY]