EUVD-2026-52817
GHSA-4qj4-pv32-cxrr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable without authentication (AV:N, PR:N), trivial to trigger errors (AC:L), impact confined to partial confidentiality disclosure with no integrity or availability effect.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit of this vulnerability might lead to information disclosure.
AnalysisAI
NVIDIA Dynamo for Linux versions 0 through v1.2.0 leaks sensitive information through crafted error message generation, exploitable remotely without authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity unauthenticated network access is sufficient to trigger disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for initial network access - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of NVIDIA Dynamo for Linux. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N positions this as a straightforward, low-complexity network exploit requiring no authentication, but with a constrained impact ceiling of partial confidentiality loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends crafted requests - such as malformed inputs or unexpected API calls - to a network-accessible NVIDIA Dynamo instance, deliberately triggering error conditions within the service. The resulting error messages are returned to the attacker and contain sensitive internal details such as file system paths, configuration parameters, or internal state. … |
| Remediation | The primary remediation is to apply the vendor-issued fix for NVIDIA Dynamo referenced in the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attacker
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or ta
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilitie
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbi
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attacke
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows una
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resou
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthen
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attac
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attack
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today