# NVIDIA rates a NeMo Agent Toolkit authentication flaw CVSS 10.0

NVIDIA says CVE-2026-65145 affects NeMo Agent Toolkit 1.0 through 1.8.0 and can expose code execution, privilege escalation, data tampering, information disclosure and denial of service over the network.[1][2] Teams should move to 1.9.0 or later and verify that no old service remains reachable.[1]

NVIDIA published its NeMo Agent Toolkit security bulletin on October 27. The company assigned CVE-2026-65145 the maximum CVSS 3.1 score because an attacker needs no privileges or user action and can reach the flaw over a network. The same bulletin covers a high-severity SQL injection issue in versions 1.4 through 1.6. NVIDIA has not published exploit mechanics, affected endpoints or evidence of attacks, so teams need to combine version inventory, network review, credential checks and upgrade verification.

## What NVIDIA disclosed

[NVIDIA's October security bulletin [1]](https://github.com/NVIDIA/product-security/blob/main/2026/5912/5912.md) describes CVE-2026-65145 as missing authentication for a critical function in NeMo Agent Toolkit. NVIDIA assigns a 10.0 CVSS 3.1 score with network access, low attack complexity, no required privileges and no user interaction.

NVIDIA says a successful attack could result in code execution, privilege escalation, data tampering, denial of service and information disclosure.[1][2] The affected range covers versions 1.0 through 1.8.0 on every supported platform, and NVIDIA directs users to version 1.9.0 or later.[1][2]

The bulletin also describes CVE-2026-65151, a local SQL injection flaw rated 8.4. NVIDIA lists versions 1.4 through 1.6 as affected and version 1.7.0 as the updated release for that issue.[1][3]

## How to decide whether a deployment is exposed

[The toolkit repository [5]](https://github.com/NVIDIA/NeMo-Agent-Toolkit) shows that teams can run workflows through command-line, UI and protocol integrations. Start with the actual running service rather than a dependency declaration that may no longer match production.

A deployment needs urgent review when it runs an affected version and an untrusted client can reach its service endpoint. The CVSS vector says the critical flaw is network-reachable, but NVIDIA has not identified the vulnerable route or configuration.[1][2]

Check every package name, container image, copied virtual environment and source installation. A repository update does not replace an older process, image or worker that remains active.

## Response checklist for NeMo Agent Toolkit operators

- Record each deployment's running version, image digest or source commit, listening address, ingress route and environment owner.
- Block public and untrusted network access to affected services while you test the update. Keep the restriction after patching unless external access is required and authenticated.
- Upgrade versions 1.0 through 1.8.0 to 1.9.0 or later. Read the 1.9.0 breaking changes before rollout because NVIDIA removed local_sandbox and changed identity handling.[4]
- Rebuild images from a trusted tag or package source. Confirm the deployed artifact rather than accepting a changed manifest as proof.
- Review service, proxy and cloud logs for unexpected requests, configuration changes, new processes, data access and outbound connections during the exposure window.
- Rotate credentials available to the service when logs or host evidence suggest unauthorized access. Prioritize model-provider keys, database credentials, cloud tokens and observability secrets.
- Test authentication and authorization on every exposed workflow, UI, WebSocket, MCP or API route after the upgrade.
- Retire old pods, containers and hosts, then scan the reachable network again to confirm that no affected instance remains.

## Why this matters for agent infrastructure

Agent runtimes can hold model keys, tool credentials, traces and permission to call external systems. NVIDIA marks the CVSS scope as changed, which means an exploited component can affect resources beyond its own security boundary.[1][2] Teams should include credentials and connected systems in their exposure review.

Teams often deploy agent frameworks as internal experiments before adding production authentication and network controls. CVE-2026-65145 makes version and reachability checks urgent even when a service was never intended for public use.

The independent report published on October 28 also identifies the maximum score, affected range and update path. It says no active exploitation or public proof of concept had been confirmed at publication time.[6]

## What remains uncertain

- NVIDIA has not identified the vulnerable endpoint, function, component or default configuration in the public bulletin.[1][2]
- The bulletin does not explain whether an attacker needs a particular service mode, plugin or workflow configuration.[1]
- NVIDIA has not published indicators of compromise, exploit mechanics or a public proof of concept.[1]
- No cited source confirms exploitation in real deployments. The absence of a public report does not prove that no exploitation occurred.
- The version 1.9.0 release predates the October 27 bulletin and does not label the security fix in its public change list.[4]
- Teams must determine their own credential and downstream-tool exposure from deployment configuration and logs.

## Frequently asked questions

- Which versions need action? NVIDIA lists NeMo Agent Toolkit 1.0 through 1.8.0 as affected by CVE-2026-65145.[1][2]
- What version contains the fix? NVIDIA directs users to version 1.9.0 or later for the critical flaw.[1]
- Does the attack require a login? The CVSS vector says no privileges are required, and NVIDIA classifies the issue as missing authentication for a critical function.[1][2]
- Is the SQL injection flaw also remote? NVIDIA gives CVE-2026-65151 a local attack vector, so teams should keep its risk separate from the network-reachable critical flaw.[1][3]
- Is upgrading enough? Teams still need to confirm the running artifact, close old instances, review exposure and inspect evidence from the time before the update.
- Should teams reproduce the flaw? Production teams can remediate from NVIDIA's affected-version guidance. Do not probe systems without explicit authorization.

## Sources

- [[1] NVIDIA: NeMo Agent Toolkit security bulletin](https://github.com/NVIDIA/product-security/blob/main/2026/5912/5912.md)
- [[2] NVIDIA: CVE-2026-65145 record](https://github.com/NVIDIA/product-security/blob/main/2026/5912/CVE-2026-65145.json)
- [[3] NVIDIA: CVE-2026-65151 record](https://github.com/NVIDIA/product-security/blob/main/2026/5912/CVE-2026-65151.json)
- [[4] NVIDIA: NeMo Agent Toolkit 1.9.0 release](https://github.com/NVIDIA/NeMo-Agent-Toolkit/releases/tag/v1.9.0)
- [[5] NVIDIA: NeMo Agent Toolkit repository](https://github.com/NVIDIA/NeMo-Agent-Toolkit)
- [[6] SecurityOnline: independent update summary](https://securityonline.info/nemo-agent-toolkit-vulnerability-cve-2026-65145)