NVIDIA Container Toolkit Flaws Enable Host Takeover via AI Containers
Two critical vulnerabilities in NVIDIA’s Container Toolkit—CVE-2024-0132 and its successor CVE-2025-23266—allow malicious container images to escape isolation and gain full control over the host system. These flaws pose severe risks to multi-tenant GPU clouds, where untrusted AI models or container images could compromise shared infrastructure, leading to unauthorized access to sensitive data, secrets, and other tenants’ workloads. Both vulnerabilities were confirmed by NVIDIA and patched in subsequent releases, but their impact underscores systemic risks in AI compute environments.
It enables attackers to exploit container images running on vulnerable hosts, granting them read access to the host filesystem and, through Unix socket manipulation, root-level command execution. The second flaw, CVE-2025-23266—dubbed NVIDIAScape*—was reported in May 2025 and affects versions up to v1.17.7 (with CDI mode restrictions for earlier versions). This vulnerability is particularly alarming due to its simplicity: a three-line Dockerfile can trigger a container escape by abusing the LD_PRELOAD environment variable during the OCI hook execution.
The NVIDIA Container Toolkit is the industry-standard solution for enabling GPU access within containerized environments, widely adopted across cloud providers, AI platforms, and Kubernetes clusters managed by the NVIDIA GPU Operator. Its integration into pre-configured AI VM images and orchestrated environments amplifies the attack surface, as shared GPU resources in multi-tenant clouds become prime targets for exploitation. Wiz Research identified these vulnerabilities during investigations into AI service providers like Hugging Face, Replicate, and SAP AI Core, where shared GPU infrastructure could inadvertently expose one tenant’s data to another through container breakout attacks.
Mechanism of Exploitation
This hook runs with elevated privileges on the host to configure GPU access for the container. CVE-2025-23266 takes advantage of the same hook but uses a more direct approach: setting the LD_PRELOAD variable in a malicious container image forces the hook to load a malicious shared library (.so file) from the container’s filesystem, bypassing isolation entirely.
An attacker need only include three lines in a Dockerfile to define a malicious payload. When the container starts, the hook inherits the LD_PRELOAD variable, loads the attacker’s library, and executes arbitrary code on the host. This simplicity makes the vulnerability highly accessible, increasing the likelihood of exploitation in environments where untrusted container images are deployed.
Impact on Multi-Tenant AI Clouds
The primary risk of these vulnerabilities lies in shared GPU environments, where multiple customers or applications run on the same physical hardware. In such setups, a malicious actor could deploy a compromised container image, escape its boundaries, and access the host’s secrets, configuration files, or even other containers running on the same node. This could lead to data breaches, unauthorized model training on stolen data, or complete compromise of the cloud service’s control plane. Wiz Research highlighted similar risks in prior disclosures affecting services like Replicate and DigitalOcean, where container escape flaws enabled cross-tenant data access.
For AI service providers, the implications are severe. Customers trusting these platforms to isolate their workloads could unknowingly share resources with malicious actors. For example, an attacker could exfiltrate proprietary models, training datasets, or API keys belonging to other tenants. The vulnerabilities also affect on-premise AI deployments, where social engineering or supply chain attacks could deliver malicious images to internal developers, leading to host compromise. Unlike many cybersecurity threats, these flaws do not require internet exposure; they can be triggered by locally deployed or internally shared container images.
Affected Versions and Mitigations
CVE-2024-0132 affects all versions of the NVIDIA Container Toolkit up to v1.16.1, while CVE-2025-23266 impacts versions up to v1.17.7 (with CDI mode restrictions for versions prior to 1.17.5). NVIDIA released patches in v1.16.2 for the first flaw and v1.17.8 for the second, along with updated versions of the NVIDIA GPU Operator (v24.6.2 and later). Organizations are strongly advised to upgrade immediately, particularly for hosts running untrusted container images or shared GPU workloads.
For environments unable to patch promptly, NVIDIA provided interim mitigations. For CVE-2025-23266, disabling the enable-cuda-compat hook via configuration files or Helm arguments can prevent exploitation. Specifically, users can set the features.disable-cuda-compat-lib-hook flag in config.toml or use the NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES environment variable in Kubernetes deployments. These measures block the primary attack vector without requiring a full toolkit upgrade, though they may limit functionality in some use cases.
Broader Implications for AI Security
These vulnerabilities reinforce a critical trend in AI security: the most immediate risks stem from infrastructure and tooling, not futuristic AI-driven attacks. The NVIDIA Container Toolkit, while essential for GPU acceleration in containers, introduces significant attack surfaces when misconfigured or unpatched. Wiz Research’s findings align with prior discoveries in AI service providers, where container escape flaws have repeatedly enabled cross-tenant data breaches. The simplicity of the CVE-2025-23266 exploit—requiring only three lines of code—highlights how even subtle design flaws can have catastrophic consequences in shared environments.
The discovery also underscores the need for rigorous supply chain security in AI deployments. Runtime validation tools can help prioritize patching efforts by identifying hosts actively using vulnerable versions of the toolkit.
Timeline of Disclosure and Response
Wiz Research reported CVE-2024-0132 to NVIDIA on September 1, 2024, with the vulnerability acknowledged and patched by September 26. For CVE-2025-23266, the initial report was submitted in May 2025 during Pwn2Own Berlin, with NVIDIA publishing a security bulletin on July 15, 2025.
Key Takeaways for Organizations
- Prioritize patching: Upgrade the NVIDIA Container Toolkit to v1.16.2 or later for CVE-2024-0132 and v1.17.8 or later for CVE-2025-23266, especially in environments running untrusted container images.
- Disable vulnerable hooks: For immediate mitigation, disable the enable-cuda-compat hook via configuration files or Helm arguments in Kubernetes clusters.
- Enforce image validation: Restrict the deployment of container images from untrusted sources and implement runtime validation to detect anomalous behavior.