al-ice.ai

A 10.0 With No Login Required: NVIDIA Patches Missing Authentication in NeMo Agent Toolkit

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 27 October 2026 NVIDIA published security bulletin 2026/5912 for NeMo Agent Toolkit covering two vulnerabilities: CVE-2026-65145, a missing-authentication flaw (CWE-306) scored CVSS 10.0, affecting versions 1.0 through 1.8.0 and fixed in 1.9.0, and CVE-2026-65151, a SQL-injection flaw (CWE-89) scored 8.4, affecting versions 1.4 through 1.6 and fixed in 1.7.0. NVIDIA credits both to external finders — Colin McDonough of 50words.com, and YJK of ZUSO ART working with Trend’s Zero Day Initiative for the 10.0 — and lists impacts up to network code execution, privilege escalation, data tampering, denial of service, and information disclosure.

The 10.0 deserves its score on the vector alone: AV:N / AC:L / PR:N / UI:N / S:C — network-accessible, low complexity, no privileges, no user interaction, changed scope. A missing-authentication flaw in an agent toolkit is about the worst place for one to live: these services sit between models and tools, routinely holding credentials and execution capability, so an unauthenticated caller reaching a sensitive endpoint inherits the agent’s reach. The affected range is also wide — nine minor versions from 1.0 to 1.8.0 — which means the flaw survived a long development window before the 1.9.0 cutoff. NVIDIA’s remediation is a straight upgrade: clone or update to 1.9.0 or later from the NVIDIA/NeMo-Agent-Toolkit GitHub repository, with no workaround on offer.

The SQL injection is the quieter sibling but still serious. At 8.4 with attack vector local, no privileges and no user interaction, CVE-2026-65151 offers data tampering, denial of service, and information disclosure to anyone with local access — the classic shared-host, container-neighbor, or compromised-sidecar scenario. Note the versioning: the fix shipped in 1.7.0, which predates this bulletin, so anyone already tracking recent releases may have closed it unknowingly, while anyone pinned to the 1.4–1.6 line is still exposed. The bulletin’s revision history shows 1.0.0 on 27 October as the initial release, so both CVEs went public the same day.

Why defenders should take this seriously — and where to discount it

The serious part is the combination of score, exposure, and venue: an unauthenticated network path to code execution inside the layer that brokers agent actions, reported through ZDI — which means professional vulnerability researchers are actively auditing agent tooling, and their findings are the floor, not the ceiling. This continues a pattern we have tracked all year of agent frameworks shipping with developer-tool trust assumptions over network-reachable services — see the NemoClaw sandbox-exfiltration and SSRF pair from May. The discount: NVIDIA claims no in-the-wild exploitation, publishes no proof of concept, and NVD still lists the CVE as Awaiting Analysis — the 10.0 is a severity assessment, not an incident report. The SQLi’s local vector also bounds its blast radius to hosts where the attacker already has a foothold. Upgrade promptly, but this is patch-now hygiene, not active-incident response.

What it means for builders and defenders

  • Upgrade NeMo Agent Toolkit to 1.9.0 or later. That single move closes both flaws (the SQLi was already fixed in 1.7.0, but 1.9.0 covers the full range). There are no workarounds in the bulletin.
  • Do not expose agent-toolkit services to untrusted networks. A 10.0 missing-auth bug is the reminder: treat every agent orchestration endpoint as internet-hostile until proven otherwise, with authentication and network segmentation in front of it.
  • Audit what your agents can reach. The impact list — code execution, privilege escalation, tampering, disclosure — is bounded in practice by the credentials and tool access the toolkit holds. Least privilege on the agent’s service account shrinks the next missing-auth bug too.
  • Watch for the ZDI disclosure. Trend ZDI-coordinated flaws typically get a detailed public advisory after the patch window. That write-up will tell you which endpoints were exposed and what to hunt for in logs.

Our verification was read-only. NVIDIA’s 2026/5912 bulletin markdown and both CVE JSON records were read first-hand in full from the NVIDIA/product-security repository (revision 1.0.0, dated 27 October 2026), including the CVE descriptions, CVSS vectors and scores, affected and fixed versions, external-finder credits, and the Trend ZDI acknowledgement; the NVD record for CVE-2026-65145 was read first-hand (published 27 October 2026, Awaiting Analysis). Secondary reporting (securityonline.info, 28 October, read first-hand) was used only as a discovery pointer. No software was downloaded beyond advisory text, no system was accessed, no exploit was run, no vendor or researcher was contacted, and all interpretation above is ours. Brave Search was used for discovery only.

Sources: