By Shweta Sharma
Publication Date: 2026-10-09 12:35:00
When publicly accessible without authentication, these endpoints could reveal a lot about an organization’s computing infrastructure, Lava says. The systems that were found exposed included Nvidia Blackwell Ultra B300 GPUs, H200s and H100s used for large-scale AI workloads, as well as consumer RTX 5090 and 4090 systems.
“Anyone who could reach these endpoints could see what hardware organizations were running, how heavily it was being used, and details about the AI infrastructure around it,” Katchinskiy warned. While such information does not provide access to model weights, training data, or other protected assets, it can help an attacker profile a target and identify weaker components or software versions.
Lava has recommended restricting public access to DCGM Exporter and Prometheus unless external access is necessary, binding exporters to loopback or private interfaces, and enforcing access controls through firewalls, security groups, or other network measures.