AMD ROCm Device Metrics Exporter Unauthenticated Access Vulnerability (CVE-2026-0481)

AMD Device Metrics Exporter (ROCm ecosystem) Vulnerability Summary Vulnerability Overview Vulnerability Name: AMD Device Metrics Exporter (ROCm ecosystem) Vulnerability AMD ID: AMD-SB-6031 CVE ID: CVE-2026-0481 CVSS Score: 9.2 (Critical) Potential Impact: Loss of Integrity and Availability Severity: Critical Technical Details: The Device Metrics Exporter (ROCm ecosystem) exposes port 50061 on all network interfaces by default, making the GPU-Agent gRPC server accessible to unauthenticated remote users. This component allows remote attackers to modify GPU configuration, potentially leading to a loss of availability. Affected Scope Affected Products: AMD Instinct™ MI2xx and MI3xx Series Affected Versions: ROCm 7.1.x and Device Metrics Exporter versions prior to 1.4.0.1 Environment Context: While Docker and Kubernetes deployment models are not affected, in modern data center environments, the actual risk is significantly reduced due to strict network access controls (firewalls, zero-trust segmentation, and restricted traffic). Remediation Recommended Upgrade Versions: - ROCm 7.1.x → Version 1.4.1.2 - ROCm 1.4.0.1 → Version 1.4.1.2 Alternative Mitigations (for environments unable to upgrade): - Isolate processes into network namespaces - Apply external firewall rules to restrict access References https://instinct.docs.amd.com/projects/device-metrics-exporter/en/latest/ Acknowledgments Thanks to Aliya Hassam and Allan Xavier from Digital Ocean for reporting this issue and participating in coordinated vulnerability disclosure. Disclaimer The information in this document is provided for informational purposes only. AMD does not assume responsibility for the accuracy or completeness of the content. Third-party content is provided "as is," and AMD assumes no liability arising from its use. © 2026 Advanced Micro Devices, Inc. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

AMD ROCm Device Metrics Exporter Unauthenticated Access Vulnerability (CVE-2026-0481)