NVIDIA AIStore Legacy ETL PodSpec Init API Unauthenticated Kubernetes Privilege Escalation

#!/usr/bin/env bash
# CVE-2026-65162 Verification Script
# Checks NVIDIA AIStore version and Kubernetes Pod Security Admission status
# Usage: ./check_cve_2026_65162.sh [namespace]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

NAMESPACE="${1:-ais}"
VULN_CVE="CVE-2026-65162"
FIXED_VERSION="5.0"

echo "=== ${VULN_CVE} Verification ==="
echo "Checking AIStore deployment in namespace: ${NAMESPACE}"
echo ""

# Check if kubectl is available
if ! command -v kubectl &>/dev/null; then
  echo "ERROR: kubectl not found in PATH"
  echo "RESULT: UNKNOWN"
  exit 2
fi

# Check if namespace exists
if ! kubectl get namespace "${NAMESPACE}" &>/dev/null; then
  echo "ERROR: Namespace '${NAMESPACE}' not found"
  echo "RESULT: UNKNOWN"
  exit 2
fi

# Find an aisnode pod
AISNODE_POD=$(kubectl get pods -n "${NAMESPACE}" -l app=ais -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
if [ -z "${AISNODE_POD}" ]; then
  AISNODE_POD=$(kubectl get pods -n "${NAMESPACE}" --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
fi

if [ -z "${AISNODE_POD}" ]; then
  echo "ERROR: No running AIStore pods found in namespace '${NAMESPACE}'"
  echo "RESULT: UNKNOWN"
  exit 2
fi

echo "Found AIStore pod: ${AISNODE_POD}"

# Get AIStore version via the daemon API
AIS_VERSION=$(kubectl exec -n "${NAMESPACE}" "${AISNODE_POD}" -- \
  curl -s http://localhost:8080/v1/daemon?what=config 2>/dev/null | \
  grep -oP '"version"\s*:\s*"\K[^"]+' | head -1 || true)

if [ -z "${AIS_VERSION}" ]; then
  # Fallback: check container image tag
  AIS_VERSION=$(kubectl get pod -n "${NAMESPACE}" "${AISNODE_POD}" \
    -o jsonpath='{.spec.containers[0].image}' 2>/dev/null | \
    grep -oP ':\K[v]?[0-9]+\.[0-9]+' || true)
fi

if [ -z "${AIS_VERSION}" ]; then
  echo "WARNING: Could not determine AIStore version"
  echo "RESULT: UNKNOWN"
  exit 2
fi

# Strip leading 'v' if present
AIS_VERSION_CLEAN=$(echo "${AIS_VERSION}" | sed 's/^v//')
echo "Detected AIStore version: ${AIS_VERSION_CLEAN}"

# Check if ETL-enabled build
ETL_ENABLED=$(kubectl get pod -n "${NAMESPACE}" "${AISNODE_POD}" \
  -o jsonpath='{.spec.containers[0].image}' 2>/dev/null | \
  grep -c 'etl' || echo "0")

if [ "${ETL_ENABLED}" -eq 0 ]; then
  echo "NOTE: AIStore image does not appear to be ETL-enabled (no '-etl' suffix)"
  echo "      Non-ETL builds lack the vulnerable ETL init API endpoint"
  echo "RESULT: PATCHED"
  exit 0
fi

echo "ETL-enabled build detected"

# Version comparison
if printf '%s\n' "${FIXED_VERSION}" "${AIS_VERSION_CLEAN}" | sort -V | head -1 | grep -qx "${FIXED_VERSION}"; then
  echo "Version ${AIS_VERSION_CLEAN} >= ${FIXED_VERSION}"
  echo "RESULT: PATCHED"
  exit 0
else
  echo "Version ${AIS_VERSION_CLEAN} < ${FIXED_VERSION} -- AFFECTED"
fi

# Check Pod Security Admission on namespace
echo ""
echo "--- Compensating Control Check: Pod Security Admission ---"
PSA_ENFORCE=$(kubectl get namespace "${NAMESPACE}" \
  -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce}' 2>/dev/null || true)

if [ -n "${PSA_ENFORCE}" ]; then
  echo "PSA enforce level: ${PSA_ENFORCE}"
  if [ "${PSA_ENFORCE}" = "restricted" ] || [ "${PSA_ENFORCE}" = "baseline" ]; then
    echo "NOTE: PSA '${PSA_ENFORCE}' mode is active -- privileged pod creation will be blocked"
    echo "      Exploitation is mitigated but upgrade is still recommended"
  fi
else
  echo "WARNING: No PSA enforce label found on namespace '${NAMESPACE}'"
  echo "         Privileged pod creation is NOT blocked by PSA"
fi

echo ""
echo "RESULT: VULNERABLE"
exit 1