What is the CVSS score of CVE-2026-47617?

CVE-2026-47617 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of NVIDIA Dynamo are affected by CVE-2026-47617?

NVIDIA Dynamo versions 0 through 1.1.0 on Linux contain a critical unauthenticated network vulnerability allowing attackers to access internal systems, cloud credentials, and sensitive APIs without…

How to fix or mitigate CVE-2026-47617?

Within 24 hours, identify all servers running NVIDIA Dynamo v0-v1.1.0 on Linux and implement emergency network segmentation to isolate the media fetcher from internal networks and cloud metadata endpoints. Within 7 days, assess whether Dynamo is operationally critical; if so, implement WAF/IDS rules to detect DNS rebinding attacks and research available patches or product alternatives. Within 30 days, either deploy a patched version when released, complete migration to an alternative solution, or validate that compensating network controls are hardened and operational.

NVIDIA Dynamo CVE-2026-47617

EUVD-2026-52812 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 nvidia

GHSA-h44j-2vgw-q5f2

Information Disclosure SSRF Nvidia Dynamo

7.5

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

DNS rebinding requires attacker-controlled DNS infrastructure and precise timing, warranting AC:H over the vendor's AC:L; no authentication needed and no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:06 vuln.today

CVE Published

Aug 04, 2026 - 17:31 cve.org

HIGH 7.5

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resources to remote unauthenticated attackers. All Dynamo releases from version 0 through v1.1.0 on Linux are affected. A successful exploit allows an attacker to manipulate the media fetcher into issuing HTTP requests to internal services, leading to high-confidence information disclosure - including potentially cloud metadata endpoints, internal APIs, or adjacent microservices. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 7.5 rating and unauthenticated network vector make this a meaningful risk in exposed deployments.

Technical ContextAI

NVIDIA Dynamo (CPE: cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:*) is an AI inference serving framework designed for distributed, multimodal workloads on Linux. Its multimodal media fetcher component resolves and retrieves external media URLs as part of inference pipelines - an architectural pattern that creates an SSRF attack surface. The root cause is classified as CWE-918 (Server-Side Request Forgery), specifically via the DNS rebinding technique: an attacker who controls a DNS server can manipulate TTL values so that an initial DNS lookup resolves to a permitted external address, and a subsequent lookup resolves to a protected internal address (e.g., 169.254.169.254 or an internal API). Because the fetcher has already whitelisted the domain from the first resolution, it proceeds to fetch the now-internal resource. This exploits the gap between DNS-level and application-level trust boundaries, a known weakness in server-side HTTP client implementations that do not re-validate resolved IPs against internal network ranges after each DNS resolution.

RemediationAI

Upgrade NVIDIA Dynamo to a version beyond v1.1.0 as indicated by the affected version range in EUVD-2026-52812; the exact fixed release version is not independently confirmed in the available data - consult the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842 for the precise patched version. If an immediate upgrade is not possible, implement egress firewall rules on the host or container network that block outbound HTTP/HTTPS requests from the Dynamo service to internal IP ranges (RFC 1918 addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the cloud metadata endpoint (169.254.169.254 and its IPv6 equivalent fd00:ec2::254). Additionally, enforce IMDSv2-only on AWS instances to require session-oriented metadata requests, which DNS rebinding cannot trivially satisfy. Note that blocking internal IP egress may affect legitimate Dynamo service mesh communication - verify network topology before applying. A DNS-level control (e.g., Response Policy Zones that block resolution of attacker-controlled domains to internal IPs) provides defense-in-depth but is not a substitute for patching.