NVIDIA NeMo Agent Toolkit: missing authentication allows unauthenticated remote code execution

CVSS 10.0CVE-2026-65145AI/ML frameworks & servingcurated

Impact

NVIDIA rates this 10.0 with a changed scope and no privileges required, meaning an unauthenticated network caller reaching a NeMo Agent Toolkit endpoint can execute code, escalate privileges, tamper with data, disclose information, or deny service, and the consequences extend past the toolkit's own security boundary. On a GPU fleet the toolkit runs as an agent/LLM orchestration service with credentials for model endpoints, vector stores and tool backends, so code execution there hands the attacker whatever that service account can reach plus the GPU pod it runs in. If the service was deployed on an internal network under the assumption that reachability equals trust, there is no authentication step to stop a lateral attacker. The NVIDIA bulletin (2026/5912) is the only detail available; the record does not name the affected endpoint or the fixed version.

Who can reach it

Anyone who can reach the NeMo Agent Toolkit service over the network. No authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

What to do

Follow NVIDIA bulletin 2026/5912 for the fixed release; the NVD record does not state a fixed version, so confirm it there before scheduling. Remediation is a toolkit upgrade and service restart rather than a node action - no GPU drain or reboot is implied. Until patched, keep the endpoint off any network a tenant or untrusted service can reach and front it with an authenticating proxy.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-65145 https://github.com/NVIDIA/product-security/tree/main/2026/5912

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.