Audits Find Widespread Critical RCE Flaws in Neocloud GPU Providers

Security audits by SemiAnalysis and researchers from ClusterMax have found widespread critical vulnerabilities across neocloud GPU providers, including cross-tenant remote code execution, an unpatched Docker CVE enabling root-level code execution, exposed BMC controllers, and leaking Grafana dashboards that expose customer credentials. SemiAnalysis found that one audited environment ran Docker Engine 29.1.3, within the affected range for CVE-2026-41567, and documented a full exploit chain achieving RCE and kernel-level privilege escalation via CVE-2026-46300. ClusterMax researchers found a cross-tenant RCE at an Asian provider and a Grafana dashboard using a single OAuth token scoped across all tenants, leaking every tenant's metrics to any querying user. The neocloud provider audited by SemiAnalysis was notified and was working with auditors to verify patches.