NVIDIA NemoClaw CVE-2026-65090

Exploitation requires an attacker to already possess a local authenticated session on the Linux host running NemoClaw - the CVSS vector PR:L confirms low-privilege local credentials are sufficient, and no elevated administrative rights are needed. The NIM management component must be active and accessible to the attacker's session, which is the default operational state for a running NemoClaw deployment. No specific non-default configuration is cited as a prerequisite. Limiting factors: the AV:L vector rules out remote unauthenticated exploitation - an attacker without existing local access (e.g., via shell, SSH, or container escape) cannot exploit this directly. The scope is unchanged (S:U), meaning exploitation does not by itself pivot to other systems beyond the compromised host.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 7.8 High, reflecting local access with low-privilege requirements and high impact across all three pillars. This is a locally-exploited vulnerability, meaning the attacker must already have a foothold on the system - reducing urgency compared to network-exploitable flaws at the same CVSS score. Attack complexity is low and no user interaction is required, so once local access is achieved the exploitation path is straightforward. EPSS data was not supplied in the intelligence feed; without it, automated exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, further tempering immediate urgency. However, in AI/ML infrastructure environments where NemoClaw nodes may be shared across users or accessible to service accounts, the low-privilege requirement meaningfully widens the attacker population. The combination of C:H/I:H/A:H means a successful exploit yields full compromise of the vulnerable host. Priority should reflect the deployment context: environments where NemoClaw instances are multi-tenant or exposed to untrusted local users should treat remediation as urgent.

A local attacker with a low-privilege account on a Linux host running NemoClaw - such as a developer, data scientist, or compromised service account with shell access - submits crafted input containing OS command metacharacters to the NIM management component's interface (CLI, API, or configuration parser). The input bypasses sanitization and is interpreted by a shell, executing attacker-supplied commands under the NemoClaw process's privileges. This yields arbitrary code execution, enabling data exfiltration, modification of model artifacts, or host disruption. No public proof-of-concept has been identified at time of analysis.