{"id":"CVE-2026-65145","published":"2026-10-27T13:16:59.860","lastModified":"2026-10-27T15:03:41.023","description":"NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5912","tags":[]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65145","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65145","tags":[]}],"exploitRefs":[{"url":"https://github.com/NVIDIA/product-security/tree/main/2026/5912","tags":[]}],"hasPoc":true,"ai":{"summary":"NVIDIA NeMo Agent Toolkit lacks authentication for a critical function, allowing unauthenticated remote attackers to trigger code execution, privilege escalation, data tampering, denial of service, and information disclosure.","exploitability":"Trivial to exploit over the network with no user interaction or prior access required due to missing authentication checks.","blast_radius":"Full system compromise is possible for any exposed instance, potentially affecting all users and downstream services relying on the toolkit.","remediation":"Upgrade to NVIDIA NeMo Agent Toolkit version 2.590 or later, which includes a fix for this missing authentication vulnerability (CWE-306).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rce","priv-escalation","info-disclosure","dos","web"],"model":"garnet-coder","analyzedAt":"2026-10-28T09:56:29.230Z"}}