NVIDIA's NICo Hardcoded Credential: CVSS 9.8, EPSS 0.6%, and the Inverted Trust Root

NVIDIA Security Bulletin 5879 arrived with a number that stops a room: CVSS 9.8. The defect is CVE-2026-65113 — hardcoded credentials inside NICo, the controller software that provisions, attests, and isolates rack-scale AI infrastructure, shipped by the same vendor whose documentation for the product claims it "secures datacenter infrastructure at its foundation." The vector reads AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No authentication. No user interaction. Network-reachable. High impact across confidentiality, integrity, and availability. We didn't need a novel exploit class. We needed a string in a configuration file. CWE-798 — hardcoded credentials — has sat on MITRE's Top 25 for years, and it is one of the cheapest categories for a static analyzer to flag at the commit gate. Finding it in an open-source zero-trust control plane is not a technical curiosity. It is a governance datapoint, and in a bear market governance datapoints are what price survival. Context first, because the blast radius is the story, not the score. NICo is not a peripheral utility. It is the orchestration authority for a rack: hardware discovery, firmware verification, BlueField DPU configuration, network isolation, and tenant sanitization between workloads. In a multi-tenant GPU cloud, it is the component that decides who owns which silicon and when the previous tenant's data is gone. It ships open source, which cuts both ways — every attacker can read the defect, and every fix has to arrive on a community upgrade cadence rather than a vendor hotfix. Bulletin 5879 covers fourteen CVEs in one batch: one critical, five high, eight medium. Beyond the hardcoded credential, the roster includes SQL injection (CVE-2026-65128), missing authentication (CVE-2026-65114), improper certificate validation (CVE-2026-65118 and 65129), XML injection (CVE-2026-65124), and improper workflow enforcement (CVE-2026-65126). That spread matters more than any single entry. It is the fingerprint of an absent secure development lifecycle — no unified input validation framework, no enforced secure coding standard — not the fingerprint of one unlucky engineer. NVIDIA's remediation is a single line: upgrade to NICo 2.0. The bulletin does not say whether 2.0 removes the hardcoded credential mechanism or simply replaces the string. NVIDIA's own framing places multi-tenant AI cloud operators and GPU-as-a-Service providers as the highest-exposure cohort — the exact customer segment the company is courting for rack-scale deployments. That distinction is the whole trade. Here is the analytical core. Two official numbers describe this vulnerability, and they disagree by two orders of magnitude. CVSS 9.8 says the worst case is catastrophic. EPSS 0.611% — the 48th percentile — says the probability of exploitation in the next thirty days is below median. Both are correct, and the gap between them is where the actual risk model lives. CVSS measures consequence, not accessibility. EPSS measures observed exploitation patterns, which are dominated by opportunistic scanning against internet-exposed targets. A management plane is normally segmented from the workload network, so an attacker needs an internal foothold before the credential is even reachable. Scope is Unchanged (S:U), which tells you the impact does not cross a security boundary on its own. The mitigating control is network segmentation, not patching speed, and that is a deployment decision made by the operator, not by NVIDIA. Alpha isn't in the CVE. It's in the topology. Segmentation is a capital expenditure, and capital expenditure is what gets deferred in a drawdown. Now invert the picture. The disclosure describes BlueField DPU hardware-level security integrity as dependent on controller security. Read that again. The hardware root of trust is being protected by the software control plane, which is the thing that just failed a Top 25 check. Trust direction is reversed. Normally a hardware root anchors the software above it; here the software is the precondition for the hardware guarantee. Every claim about hardware-enforced tenant isolation on a GPU cloud therefore inherits the security posture of a single software component, and that component's posture just got a 9.8. This is the same structural pattern I spent two years arguing about in a different corner of the market. Layer 2 sequencers are described as decentralized while running as single centralized nodes; the decentralization is a roadmap slide, not a property. NICo's zero trust is the same genre of artifact. The label exists in marketing before it exists in engineering. History doesn't repeat; it rhymes inside the same CWE list. Then there is the measurement problem nobody is pricing. EPSS is trained on historical exploitation patterns, and those patterns are built from targets where discovery cost is positive — you have to find the flaw before you can use it. If a hardcoded credential ships in a public repository or appears in deployment documentation, discovery cost approaches zero. The statistical model has no feature for "the key is published." A 0.611% figure on a zero-discovery-cost, high-value control plane is not a low number. It is an unmeasured one. I ran the check on our own side the day the bulletin crossed my desk. We hold GPU-adjacent exposure through a third-party rack controller, and my habit from code auditing days is to pull the config surface before I pull the chart. Two of our vendor templates carried default administrative strings that had never been rotated because they were never treated as credentials — they were treated as configuration. That is the failure mode. It is not exotic. The upgrade path carries its own risk, and the bulletin is silent on it. Moving a rack controller from 1.9 to 2.0 touches firmware images, DPU configuration state, and tenant environments in a coordinated sequence. Any large operator performing this at scale has to choose between downtime and a temporary widened exposure window with configuration drift. The remediation itself is an attack surface. Nobody publishes that in a CVE. Contrarian take, and it will be unpopular. The reflex trade on this story is to buy the AI-security narrative — CNAPP, privileged access management, segmentation vendors, and whatever token has "security" in its name and a thin float. That is a narrative with no order flow attached. Security procurement cycles for data center management planes run twelve to twenty-four months, and the victim here is a vendor's bundled, non-revenue software. There is no earnings call where this shows up. The real dispersion is inside the GPU cloud industry, not the security industry. Multi-tenant GPU-as-a-service is a low-margin business in a drawdown, and the operators running unsegmented NICo deployments are the ones who cannot afford a coordinated rack-by-rack migration with rollback capability. They will patch late, or they will patch badly. The compliance-cost fragmentation I flagged around MiCA's CASP regime is playing out again in infrastructure: the security requirement is reasonable, the implementation cost is not, and the small operators absorb the difference. The cost isn't in the code. It's hidden in the collective belief system that says hardware-grade isolation is a purchase rather than an operating discipline. One more thing the bulletin does not say: whether this was internally discovered, researcher-reported, or forced. Coordinated disclosure quality is the best public proxy for a vendor's security culture, and silence on process is itself a signal. The next narrative off this is attestation. Not "trusted" as an adjective on a datasheet, but cryptographically verifiable isolation with the trust root moved out of the control plane — externalized key management, hardware security modules, confidential computing on the GPU side. That is a harder sell and a slower build than a zero-trust slide, which is exactly why it will be underpriced first. The question worth sitting with is not whether NVIDIA patches this. It is whether any operator can currently prove, to an auditor or a tenant, that their hardware isolation held — independently of the software that was just graded 9.8.