What is the CVSS score of EUVD-2026-52805?

EUVD-2026-52805 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of NVIDIA Dynamo are affected by EUVD-2026-52805?

NVIDIA Dynamo for Linux creates a critical confidentiality breach risk through an unauthenticated server-side request forgery in versions through v1.1.0, allowing remote attackers to extract…

How to fix or mitigate EUVD-2026-52805?

Within 24 hours, identify and document all systems running NVIDIA Dynamo for Linux v1.1.0 or earlier, assess their network exposure (internet-facing, DMZ, internal-only), and isolate publicly-accessible endpoints from untrusted networks. Within 7 days, deploy network-level compensating controls including request filtering to block suspicious file path patterns and firewall rules restricting Dynamo access to known-good sources; simultaneously engage NVIDIA support to inquire about available patches or interim security measures. Within 30 days, establish a timeline for patching or migration-either deploying a released patch from NVIDIA once available or evaluating alternative inference serving solutions if no patch is forthcoming.

NVIDIA Dynamo EUVD-2026-52805

| CVE-2026-47613 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 nvidia

GHSA-prwc-w88m-jpv7

Information Disclosure SSRF Nvidia Dynamo

7.5

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable inference API requires no authentication per vendor assignment; only confidentiality is impacted via local file read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:04 vuln.today

CVE Published

Aug 04, 2026 - 17:25 cve.org

HIGH 7.5

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by supplying a crafted local path in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers to read arbitrary local files by embedding a crafted local path inside a multimodal inference request. The Dynamo serving layer fails to restrict the path to an allowed directory, causing the server to resolve and return content from restricted filesystem locations, leading to high-confidentiality information disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and lack of authentication requirements make this straightforward to exploit against any exposed Dynamo endpoint.

Technical ContextAI

NVIDIA Dynamo is an AI inference serving framework for Linux designed to handle multimodal requests (e.g., combining text, images, and file references) destined for large language and multimodal models. CWE-918 identifies this as Server-Side Request Forgery: when a client supplies a crafted local file path (e.g., a file:// URI or a relative path escape sequence) inside a multimodal request payload, the Dynamo backend resolves that path on the server filesystem rather than rejecting or sanitizing it. The affected CPE is cpe:2.3:a:nvidia:dynamo:*:*:*:*:*:*:*:*, covering all releases from version 0 through v1.1.0. The root cause is absent or insufficient canonicalization and allow-list validation of user-supplied path parameters before the server performs local I/O on them. Despite the description's language about 'improper limitation of a pathname to a restricted directory' (language typically associated with CWE-22 path traversal), the assigned CWE-918 and the 'SSRF' tag together indicate that the flaw is architecturally a server-side request originating from attacker-controlled input, with the local filesystem as the targeted resource.

RemediationAI

The primary remediation is to upgrade NVIDIA Dynamo beyond v1.1.0 to a version that addresses path sanitization in multimodal request handling; consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842 for the confirmed fixed release version, which was not independently specified in available intelligence at time of analysis. Upstream fix availability should be verified directly with NVIDIA before deployment. As a compensating control where patching is not immediately feasible, restrict network access to Dynamo inference endpoints to trusted clients only (e.g., via firewall rules or service-mesh policy), which reduces the unauthenticated network attack surface without eliminating the underlying flaw. Additionally, run the Dynamo service under a least-privilege OS account with file-system access scoped exclusively to model artifacts and required data directories, limiting the set of files an attacker can exfiltrate even if the SSRF flaw is triggered. Note that network restriction does not remediate the root cause and should be treated as a temporary measure only.