What is the CVSS score of EUVD-2026-52806?

EUVD-2026-52806 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of NVIDIA Dynamo are affected by EUVD-2026-52806?

NVIDIA Dynamo for Linux versions 0 through v1.1.0 contain an unauthenticated server-side request forgery vulnerability enabling remote attackers to force the server to access internal services, cloud…

How to fix or mitigate EUVD-2026-52806?

Within 24 hours, inventory all systems running NVIDIA Dynamo for Linux, identify which are running versions 0 through v1.1.0, and assess network exposure (internal vs. internet-facing). Within 7 days, implement network segmentation using firewall rules or security groups to restrict inbound access to Dynamo services; enable logging and monitoring for outbound HTTP requests from Dynamo processes to internal IP ranges and cloud metadata endpoints (169.254.169.254, etc.); and establish an incident response plan for potential exploitation. Within 30 days, contact NVIDIA Support for guidance on patched versions or interim workarounds; evaluate implementing WAF rules to detect SSRF patterns; restrict network egress from Dynamo services to approved endpoints only; rotate any cloud credentials or IAM tokens that may have been accessible from affected systems; and develop a timeline for upgrading to a patched version or decommissioning affected deployments.

NVIDIA Dynamo EUVD-2026-52806

| CVE-2026-47614 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 nvidia

GHSA-3q7g-m267-rp98

Nvidia SSRF Information Disclosure Dynamo

7.5

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible SSRF requiring no credentials; impact is confidentiality-only via internal resource exposure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:04 vuln.today

CVE Published

Aug 04, 2026 - 17:26 cve.org

HIGH 7.5

DescriptionCVE.org

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attackers to cause the server to issue arbitrary backend HTTP requests. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-exploitable with no authentication or user interaction required, making this accessible to any attacker who can reach the Dynamo service. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Dynamo service endpoint

Delivery

Send crafted request with attacker-controlled URL

Exploit

Dynamo server issues backend HTTP request

Execution

Internal resource responds to forged request

Impact

Attacker receives internal service data or credentials

Access

Identify exposed Dynamo service endpoint

Delivery

Send crafted request with attacker-controlled URL

Exploit

Dynamo server issues backend HTTP request

Execution

Internal resource responds to forged request

Impact

Attacker receives internal service data or credentials

Vulnerability AssessmentAI

Exploitation	The CVSS:3.1 vector PR:N/UI:N confirms exploitation requires no authentication and no user interaction - any attacker with network access to the Dynamo service endpoint can attempt exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 High score is driven by network accessibility (AV:N), low complexity (AC:L), and no authentication requirement (PR:N/UI:N), with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP request to an internet- or network-exposed NVIDIA Dynamo instance, embedding a URL targeting an internal resource such as the AWS instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) or an internal API. The Dynamo server fetches the target URL and returns or leaks the response, allowing the attacker to harvest cloud credentials, internal tokens, or private service data. …
Remediation	The primary remediation is to upgrade NVIDIA Dynamo to a version beyond v1.1.0 per the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842 - an exact patched release version is not independently confirmed from the available reference data, so consult the advisory directly for the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running NVIDIA Dynamo for Linux, identify which are running versions 0 through v1.1.0, and assess network exposure (internal vs. …

Threat intelligence, references, and detailed analysis are available after sign-in.