CVE-2026-65098

CriticalCVSS 9.8/10Last modified Sep 1, 2026

Description

NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1390

Affected software

Vendor	Product	Versions
NVIDIA	NemoClaw	0 to 0.0.4

References

https://github.com/NVIDIA/product-security/tree/main/2026/5872Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-65098US Government Resource
https://www.cve.org/CVERecord?id=CVE-2026-65098Third Party Advisory

Timeline

Published: Aug 25, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-650997.8NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A succ CVE-2026-65109.8The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including CVE-2026-651004.8Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure l CVE-2026-651018.6NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forger CVE-2026-651027.8NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YA CVE-2026-651038.1NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote a CVE-2026-651047.1NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used CVE-2026-651058.1NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service w CVE-2026-651076.3NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a CVE-2026-651086.3NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root CVE-2026-651094.7NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of CVE-2026-65115.5During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows