CVE-2026-65145

10 CRITICALpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI risk analysis

Summary: NVIDIA NeMo Agent Toolkit lacks authentication for a critical function, allowing unauthenticated remote attackers to trigger code execution, privilege escalation, data tampering, denial of service, and information disclosure.
Exploitability: Trivial to exploit over the network with no user interaction or prior access required due to missing authentication checks.
Blast radius: Full system compromise is possible for any exposed instance, potentially affecting all users and downstream services relying on the toolkit.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to NVIDIA NeMo Agent Toolkit version 2.590 or later, which includes a fix for this missing authentication vulnerability (CWE-306).

auth-bypassrcepriv-escalationinfo-disclosuredosweb

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-306

Public exploit & PoC references

https://github.com/NVIDIA/product-security/tree/main/2026/5912

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.