NVIDIA NemoClaw CVE-2026-65096

The Telegram bridge component of NemoClaw must be enabled and running; deployments that do not use the Telegram integration are not exposed through this specific vector. A local user account with at least low-level system privileges (PR:L) is required - fully unauthenticated remote exploitation is not supported by the CVSS vector (AV:L). No user interaction from a second party is needed (UI:N), so the attacker can trigger the condition unilaterally once they have local access and can supply crafted input to the bridge. Exploitation is limited to Linux; Windows or other platform deployments are not covered by this CVE. The wildcard CPE implies no specific configuration flag beyond bridge enablement is documented as a prerequisite.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, reflecting local network access, low complexity, and low privilege requirements with high impact across all three pillars. The local attack vector (AV:L) limits opportunistic internet-facing exploitation, but any multi-tenant or shared Linux system running NemoClaw with the Telegram bridge enabled becomes a lateral movement target once an attacker achieves any foothold on the host. The unchanged scope (S:U) suggests impact is bounded to the vulnerable system itself, not cascading to adjacent systems via the vulnerability mechanism alone. No EPSS percentile data was provided in the source intelligence, and the CVE is not listed in CISA KEV, so no confirmed active exploitation signal exists. The absence of a public POC further tempers urgency relative to a KEV-confirmed issue. Nevertheless, AC:L and PR:L together mean exploitation is straightforward for any low-privileged local user, making this a meaningful internal privilege escalation risk in shared or containerized AI workload environments - even a mid-sized deployment team running shared GPU nodes should treat this as urgent pending patch availability.

A low-privileged user on a shared Linux GPU node running NemoClaw with the Telegram bridge enabled crafts a malicious string - such as a specially formatted Telegram message or a manipulated configuration value - that is passed unsanitized to a shell command within the bridge component. The injected shell metacharacters cause the application to execute attacker-controlled commands under the NemoClaw process identity, potentially granting access to higher-privileged files or enabling persistence mechanisms. No public proof-of-concept code has been identified, but the low complexity rating indicates the technique does not require specialized tooling.