NVIDIA NeMo Agent Toolkit (Web UI): The chat API endpoint is vulnerable to server-side request forgery, so an attacker

CVSS 7.6CVE-2025-33203NVIDIA / GPU stackcurated

Impact

The chat API endpoint is vulnerable to server-side request forgery, so an attacker makes the toolkit issue requests to internal endpoints - cloud metadata services and in-cluster APIs being the obvious targets. In an AI datacenter this is the model-and-data supply chain problem: the code runs with whatever the training or inference job holds, which is usually a GPU, a service account, and mounted object storage credentials.

Who can reach it

Requires the job to load an attacker-influenced artifact - a checkpoint, .nemo file, config, tokenizer or dataset. Any pipeline that pulls from a public model hub, a customer bucket, or a tenant-supplied path is in scope.

What to do

Bump the package to the fixed version in bulletin 5726 and rebuild every training/inference image that embeds it. Cost: image rebuild and job restart; no host driver or firmware change. The durable control is refusing to deserialize untrusted checkpoints at all - prefer safetensors-style formats and treat pickle-bearing artifacts as executable code.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-33203 https://github.com/NVIDIA/product-security/tree/main/2025/5726

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.