NVIDIA NemoClaw CVE-2026-65087

Exploitation requires: (1) local access to the target host running NVIDIA NemoClaw (AV:L - no remote exploitation path), (2) a low-privileged user account on that system (PR:L), and (3) user interaction (UI:R) - likely a legitimate user or scheduled process triggering a NemoClaw operation that causes credential exposure, such as authentication, workflow execution, or configuration loading. The Unchanged scope (S:U) indicates exploitation is bounded to NemoClaw's own security context on the local system. Key limiting factors: no network-based attack surface, no unauthenticated exploitation path, and the user-interaction requirement prevents fully autonomous or automated exploitation without a social engineering or timing component. The specific NemoClaw feature or operation that triggers credential exposure is not detailed in available data, preventing more precise condition scoping.

Real-world risk is moderate-to-low for most environments. The local attack vector (AV:L) eliminates remote exploitation, fundamentally limiting the attack surface to users or processes with existing system access. Low privileges required (PR:L) and user interaction required (UI:R) add additional exploitation friction, reducing opportunistic or automated attack viability. The high confidentiality impact (C:H) is the primary concern - exposed credentials could enable privilege escalation or lateral movement in credential-reuse scenarios, which is a meaningful secondary risk in AI/ML pipeline environments that often authenticate to cloud storage, model registries, or orchestration platforms. No EPSS data was provided, no CISA KEV listing exists, and no POC is known, all consistent with a low active-exploitation threat. The primary realistic threat actor is a malicious insider, a compromised low-privileged account on the same host, or an attacker who has already achieved initial access and is conducting post-exploitation credential harvesting.

An attacker with a low-privileged local account on a system running NVIDIA NemoClaw performs or induces a user-interaction step - such as running an AI workflow, initiating a training job, or triggering an authentication routine - that causes NemoClaw to write or expose credential material to a location readable by the attacker (e.g., a log file, temp directory, or process memory). The attacker reads those credentials and reuses them to authenticate to connected services such as cloud storage buckets, model registries, or orchestration APIs. No public exploit code has been identified at time of analysis.