Database/AI/ML frameworks & serving
NVIDIA NeMo Agent Toolkit: SQL injection allows data tampering and disclosure
Impact
A local attacker can inject SQL into the toolkit's database layer, giving data tampering, information disclosure and denial of service. Where the toolkit backs agent state, tool registries or conversation history with a database, tampering means an attacker can rewrite what agents believe and which tools they are allowed to call, which is a durable foothold rather than a one-shot read. The CVSS vector is local with no privileges required (AV:L/PR:N), so the realistic path is a co-resident process or a tenant workload on the same node, not an internet caller. This is a distinct flaw from the missing-authentication issue in the same NVIDIA bulletin 2026/5912; the record does not name the affected query path or the fixed version.
Who can reach it
Local access to the host or container running NeMo Agent Toolkit; the vector states no privileges and no user interaction are required. On a shared GPU node this includes any tenant workload able to submit input that reaches the toolkit's database layer.
What to do
Upgrade to the release named in NVIDIA bulletin 2026/5912 and restart the toolkit service; the NVD record gives no fixed version, so take it from the bulletin. No firmware or node-level maintenance is implied. Interim mitigation is to stop untrusted workloads from sharing a host with the toolkit and to limit the database account's privileges to what the toolkit actually needs.
References
Related entries
- Eclipse Che: authenticated SSRF in devfile URL fetching leaks the pod service-account tokenCVE-2026-86671 · Eclipse Che (URLFetcher in /api/scm/resolve and /api/factory/resolver)High
- Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh
- vLLM: malformed multimodal embedding input crashes the engine and drops every in-flight requestCVE-2025-62372 · vLLM (multimodal embedding input validation)High
- LangChain: template injection in prompt templates exposes Python object internalsCVE-2025-65106 · LangChain ChatPromptTemplate (prompt template parsing)High
- vLLM: --revision pin ignored for some FunAudioChat and Tarsier2 processor, tokenizer and config loadsCVE-2026-100653 · vLLM (revision pin not propagated to FunAudioChat and Tarsier2 Hugging Face artifact loads)High
- vLLM: prompt_logprobs over a KV-connector-cached prefix crashes EngineCore for all co-tenantsCVE-2026-116180 · vLLM (LogprobsTensors.empty_cpu / V1 model runner prompt_logprobs with KV connector)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.