NemoClaw: SSRF

CVSS 5.9CVE-2026-24231NVIDIA / GPU stackcurated

Impact

SSRF -> internal service access from a tenant-facing service

Who can reach it

Tenant supplying a crafted URL

What to do

Upgrade the service; add egress network policy

References

https://nvd.nist.gov/vuln/detail/CVE-2026-24231 https://github.com/NVIDIA/product-security/tree/main/2026/5837

Related entries

NemoClaw: Sensitive info exposure in logsCVE-2026-24222 · NemoClawHigh
Triton Inference Server: Use-after-free in request processingCVE-2026-24266 · Triton Inference ServerMedium
vGPU Manager: Host impact via GPU command-buffer overflowCVE-2026-24201 · vGPU ManagerMedium
DGX H100 BMC (IPMI): Info disclosureCVE-2023-25534 · DGX H100 BMC (IPMI)Medium
CUDA Toolkit: Info disclosure / DoS (buffer over-read)CVE-2025-23272 · CUDA ToolkitMedium
NVIDIA DGX Spark (GB10) - SROOT / OSROOT root-of-trust firmware: An invalid memory read in OSROOT firmware crashesCVE-2025-33191 · NVIDIA DGX Spark (GB10) - SROOT / OSROOT root-of-trust firmwareMedium

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.