NVIDIA NemoClaw CVE-2026-24231

Exploitation requires three specific conditions to be met simultaneously: (1) local file system access to either create or modify NemoClaw blueprint configuration files, or ability to invoke NemoClaw CLI commands with attacker-controlled parameters; (2) the endpoint URL must reference an address within the 0.0.0.0/8 address range (0.0.0.0 to 0.255.255.255); and (3) user interaction to execute the configuration load or CLI command. The vulnerability does not affect remote, unauthenticated attackers or scenarios where configuration files are read-only and CLI access is restricted to trusted administrators. The impact is limited to information disclosure from internal services accessible from the NemoClaw process's network context; the attacker cannot modify or delete data, and cannot cause denial of service.

The CVSS score of 6.3 with AV:L (local), AC:L (low complexity), PR:N (no privileges), UI:R (requires user interaction), S:C (scope changed), C:H (high confidentiality impact), and A:N (no availability impact) indicates moderate real-world risk with significant practical limitations. The local attack vector severely restricts exploitation to scenarios where an attacker already has shell access or can modify files on the target system. The requirement for user interaction (UI:R) further constrains impact-either an administrator must run a malicious CLI command or edit a blueprint configuration file. The high confidentiality impact reflects the SSRF's ability to disclose sensitive information from internal services. However, the absence of integrity or availability impact suggests the vulnerability is read-only exploitation. EPSS data is not provided, and no KEV status or POC availability is confirmed, suggesting this may be a theoretical or limited-scope vulnerability rather than actively exploited. The combination of local-only attack vector, required user interaction, and lack of active exploitation signals suggests this is lower priority than remote-accessible or unauthenticated SSRF variants, though organizations where untrusted users have local access should still prioritize patching.

A local user on a system running NemoClaw crafts a blueprint configuration file that instructs NemoClaw to connect to an internal service at 0.1.2.3 (within the 0.0.0.0/8 range), which normally would be blocked by the SSRF filter. The local user then triggers NemoClaw to load this configuration-either by running a CLI command with the crafted file as input or by placing the file in an auto-loaded configuration directory. NemoClaw's validateEndpointUrl() function incorrectly allows the request due to its improper handling of the 0.0.0.0/8 range, permitting the application to make a request to the internal service and disclose sensitive information (API responses, database errors, configuration data, etc.) back to the attacker.