NVIDIA NemoClaw CVE-2026-65088

Exploitation requires a local account with at minimum low-privilege access (PR:L per CVSS vector) on the same system where NemoClaw is actively executing. The attacker must be present on the system concurrently with a running NemoClaw process that passes sensitive values through its invocation arguments or visible environment variables. No network access is required and remote exploitation is not possible given AV:L. The vulnerability does not require elevated privileges (no root or admin access needed), but it does require an active local shell session on the target host. Exploitation is bounded to the window when a NemoClaw process is running - if the process exits before the attacker reads /proc/<pid>/cmdline or runs ps, the opportunity is lost. Systems where all local users are fully trusted, or where NemoClaw runs in isolated containers with no co-resident untrusted users, are not practically exploitable.

The CVSS 3.1 score of 5.5 Medium reflects the constrained local attack surface (AV:L), low-privilege requirement (PR:L), and absence of integrity or availability impact. The local-only vector substantially limits the threat compared to network-exploitable vulnerabilities - this cannot be triggered remotely. The C:H rating is significant in AI/ML deployment contexts: NemoClaw processes may handle API keys for cloud GPU services, model registries, or data pipelines, meaning credential theft could enable meaningful downstream access to privileged infrastructure. No EPSS score was provided in the available intelligence, and the vulnerability is absent from CISA's KEV catalog with no public proof-of-concept identified, placing this in a lower-urgency band for most organizations. The primary risk concentration is on shared multi-user AI workstations or HPC clusters where multiple users share the same host OS - environments common in research and academic ML deployment. For organizations running NemoClaw on isolated single-user systems or within containerized environments with strict namespace isolation, real-world exploitability is further reduced. Overall, the vulnerability is a real but bounded risk: technically confirmed by NVIDIA, low exploitation likelihood in practice, but warranting prompt patching wherever untrusted users share compute resources.

A low-privileged user on a shared AI workstation or HPC node runs ps aux or reads /proc/<pid>/cmdline while a NemoClaw process is active, capturing an API key or authentication token passed as a command-line argument. With the recovered credential, the attacker authenticates to a downstream cloud service, model registry, or data pipeline to which NemoClaw had authorized access. No public proof-of-concept exploit code has been identified, and the attack requires the attacker to be on the same host concurrently with an active NemoClaw process.