CVE-2026-24186 + CVE-2026-24178: FOBS Deserialization and Authentication Bypass in NVFLARE -- 2026
| CVE | Score | Component | Type | Disclosed |
|---|---|---|---|---|
| CVE-2026-24186 | High | NVIDIA FLARE SDK — FOBS component | Insecure deserialization RCE | 2026 |
| CVE-2026-24178 | High | NVFlare Dashboard | Authentication bypass via user-controlled key | 2026 |
For executives
NVFLARE disclosed two further high-severity vulnerabilities in 2026. CVE-2026-24186 is an insecure deserialization vulnerability in NVFLARE's FOBS (Federated Object Binary Serialization) component — the same class of vulnerability that produced CVE-2022-34668 in 2022, now in a different serialisation system. CVE-2026-24178 is an authentication bypass in the NVFlare Dashboard where user-controlled key manipulation allows an unauthenticated attacker to bypass authorization controls entirely.
CVE-2026-24186: FOBS deserialization
When NVIDIA patched CVE-2022-34668 in 2022, it replaced pickle with MessagePack. The 2026 disclosure targets FOBS — a newer serialisation component introduced to handle complex object types that MessagePack cannot natively support. The FOBS deserialiser fails to verify whether incoming messages contain safe content before processing them. An attacker with low-privilege access to the federated learning network can craft a FOBS message with malicious serialised objects that executes attacker-controlled code.
The pattern is the same as CVE-2022-34668 despite the different serialisation mechanism: replacing one serialisation library with another does not eliminate the attack class if the replacement is also used to process untrusted input.
CVE-2026-24178: NVFlare Dashboard authentication bypass
CVE-2026-24178 is an authorization bypass classified under CWE-639 (Authorization Bypass Through User-Controlled Key). An attacker can manipulate a user-controlled key to bypass access control checks, reaching administrative functions without valid credentials.