NVIDIA has patched a high-severity flaw in its DCGM Exporter, tracked as CVE-2026-47483, which scores 8.2 on CVSSv3. The vulnerability affects the DCGM Exporter across all platforms and could allow unauthenticated attackers to flood the exporter’s profiling endpoints and crash GPU monitoring. The advisory notes that the /debug/pprof endpoints and related metrics can be reached over HTTP, and in exposed deployments, this can lead to memory exhaustion and a crash of the monitoring service.
Exploitation in the wild has not been confirmed, with official guidance indicating no confirmed public exploits, and researchers conducting tests in controlled lab environments.
Evidence cited by researchers from Lava Security shows that thousands of DCGM Exporter instances were exposed on the public internet. In scans between March and May 2026, Lava observed roughly 2,100 hosts serving exporter metrics, reporting more than 12,000 GPUs across organisations. The exposed environment included a range of GPUs from consumer to data‑centre cards, such as H100, H200, and Blackwell generation cards, with some instances running on current hardware visible to the open internet.
The majority of these deployments responded over plaintext HTTP and offered unauthenticated access to metrics, increasing risk for operators who rely on these exporters for GPU monitoring.
Patches and mitigating steps are straightforward: upgrade to DCGM Exporter version 4.8.2 or later, disable the Go profiling endpoint unless needed (–enable-pprof is opt-in in current releases), bind exporters to loopback or private interfaces, and restrict access via firewalls or security groups so only monitoring systems can connect. Additional guidance includes hardening Prometheus query APIs and target pages, and setting alerts for unexpected exporter crashes.
The broader takeaway is that public exposure of monitoring tools can reveal infrastructure details and degrade GPU health visibility, underscoring the importance of least-privilege access and network segmentation.