EUVD-2026-52809
GHSA-hc3w-j3wp-q93q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable inference API with no credential requirement; SSRF yields confidentiality impact only, no integrity or availability consequence.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.
AnalysisAI
Server-side request forgery in NVIDIA Dynamo for Linux (all versions through v1.1.0) allows unauthenticated remote attackers to force the inference server to issue arbitrary HTTP requests by embedding a crafted URL inside a multimodal inference request payload. Successful exploitation exposes internal network resources reachable from the Dynamo host, producing high-severity information disclosure without requiring any credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Dynamo inference endpoint must be reachable over the network by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (High) is driven entirely by the C:H impact metric, with network reachability and zero authentication requirements (PR:N) making the attack surface broad. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an exposed NVIDIA Dynamo inference endpoint submits a multimodal inference request where the media URL field is replaced with an internal address such as http://169.254.169.254/latest/meta-data/ or an internal microservice URL. The Dynamo server fetches the URL server-side as part of input processing and the response content - potentially including cloud credentials, internal API tokens, or service responses - is returned to or observable by the attacker, achieving unauthenticated access to internal resources. … |
| Remediation | Upgrade NVIDIA Dynamo to a version beyond v1.1.0 as directed by the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5842; the exact patched release version is not independently confirmed from available data, so consult the advisory for the specific target version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NVIDIA Dynamo deployments and identify which instances are network-exposed or process untrusted inference payloads; isolate critical instances or restrict network access immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attacker
Deserialization of untrusted data in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) exposes unauthenticated remote
Out-of-bounds write in NVIDIA Dynamo for Linux enables remote unauthenticated attackers to cause denial of service or ta
Remote code execution, data tampering, denial of service, and information disclosure are possible through vulnerabilitie
Path traversal in NVIDIA Dynamo's image loading component on Linux enables unauthenticated remote attackers to read arbi
Hash collision exploitation in NVIDIA Dynamo's multimodal embedding cache on Linux allows unauthenticated remote attacke
Server-side request forgery in NVIDIA Dynamo's Rust multimodal media fetcher (Linux, versions through v1.1.0) allows una
Server-side request forgery via DNS rebinding in NVIDIA Dynamo's multimodal media fetcher exposes internal network resou
Server-side request forgery in NVIDIA Dynamo's multimodal media fetcher (Linux, versions through v1.1.0) allows unauthen
Server-side request forgery in NVIDIA Dynamo for Linux (versions 0 through v1.1.0) enables unauthenticated remote attack
Server-side request forgery in NVIDIA Dynamo for Linux (versions through v1.1.0) allows unauthenticated remote attackers
Race condition during LoRA manager singleton initialization in NVIDIA Dynamo for Linux (all versions through v1.1.0) all
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today