What is the CVSS score of CVE-2026-47622?

CVE-2026-47622 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

NVIDIA Dynamo CVE-2026-47622

EUVD-2026-52817 MEDIUM

Error Message Information Leak (CWE-209)

2026-08-04 nvidia

GHSA-4qj4-pv32-cxrr

Information Disclosure Nvidia Dynamo

5.3

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable without authentication (AV:N, PR:N), trivial to trigger errors (AC:L), impact confined to partial confidentiality disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:10 vuln.today

CVE Published

Aug 04, 2026 - 17:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

NVIDIA Dynamo for Linux versions 0 through v1.2.0 leaks sensitive information through crafted error message generation, exploitable remotely without authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity unauthenticated network access is sufficient to trigger disclosure. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, indicating this is not currently confirmed as actively exploited at scale.

Technical ContextAI

CWE-209 (Generation of Error Message Containing Sensitive Information) identifies a root cause where application error handling inadvertently embeds internal state - such as stack traces, file paths, configuration values, or credentials - into responses visible to the requester. NVIDIA Dynamo is a distributed AI inference framework designed for high-throughput model serving on Linux. The CPE string cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:* covers all versions through v1.2.0 per EUVD-2026-52817. The vulnerability exists because error conditions reachable via the network surface are not sanitized before the resulting messages are returned, making the information accessible to unauthenticated callers.

RemediationAI

The primary remediation is to apply the vendor-issued fix for NVIDIA Dynamo referenced in the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842. An exact patched version number is not confirmed in the available input data and must be verified directly with NVIDIA before upgrading. As compensating controls pending the patch, administrators should restrict network access to Dynamo API endpoints to trusted internal clients only using firewall rules or network segmentation, directly limiting exposure to unauthenticated external actors. Additionally, configuring a reverse proxy or API gateway in front of Dynamo to intercept and strip verbose error responses before they reach clients can suppress information leakage without requiring an application change, though this adds a dependency on the proxy's error-handling logic and may complicate debugging.