NVIDIA NeMo Agent Toolkit 1.0 to 1.8.0: network-reachable missing authentication, CVE-2026-65145 (10.0), and a local SQL injection CVE-2026-65151; fixed 1.9.0

View raw markdownEdit on GitHub ↗

TL;DR

NVIDIA's October bulletin for the NeMo Agent Toolkit (2026-10-27) carries CVE-2026-65145, a missing authentication check that "might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure," scored 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) for versions 1.0 to 1.8.0 on all platforms, and CVE-2026-65151, a SQL injection scored 8.4 and local for versions 1.4 to 1.6. The fix is 1.9.0, which PyPI dates to 2026-09-10, seven weeks before the bulletin; the SQL injection was fixed in 1.7.0 (2026-05-21). NVIDIA names neither the component nor the endpoint. If a toolkit server on 1.8.0 or earlier is reachable by anyone you would not hand its host to, upgrade now and review what it could reach.

What happened

The NeMo Agent Toolkit is NVIDIA's open-source framework for building and serving agents and MCP tools (PyPI nvidia-nat, the GitHub NVIDIA/NeMo-Agent-Toolkit repository); the corpus has two earlier NVIDIA agent-stack files (NemoClaw and OpenShell, DCGM exporter) and none for this product. On 2026-10-27 NVIDIA published bulletin 5912, "Security Bulletin: NeMo Agent Toolkit - October 2026" (revision 1.0.0, initial release), on its product-security repository, and the NVIDIA CNA published the two records the same day; the GitHub Advisory Database carried both as unreviewed rows the same day.

  • CVE-2026-65145 — missing authentication (10.0, Critical, CWE-306). "NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure." Affected 1.0 to 1.8.0, all platforms; fixed 1.9.0. Acknowledged: Colin McDonough of 50words.com, and YJK (@YJK0805) of ZUSO ART working with Trend's Zero Day Initiative.
  • CVE-2026-65151 — SQL injection (8.4, High, CWE-89, AV:L). "A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure." Affected 1.4 to 1.6; fixed 1.7.0. Acknowledged: Colin McDonough.

That is the whole of what the vendor says. The bulletin's "update to 1.9.0 or later" is the only remediation, "these issues were found externally" the only process note, and the record names no endpoint, route, service or configuration. The scores are the vendor's own (the NVIDIA CNA supplied both vectors; there is no ADP score on the records as of 2026-10-28), and this file's critical follows the 10.0 on the network-reachable, no-privilege, scope-changed vector rather than any demonstrated outcome, which the vendor has not published. Two things a reader can take from the dates: the 1.9.0 release that closes the Critical reached PyPI on 2026-09-10 (after four alphas and four release candidates from 08-09), so a deployment that tracks releases has been fixed for seven weeks without knowing it, and a deployment pinned to 1.8.0 (2026-06-17) or earlier has been on an unauthenticated network path for as long as it has been reachable. The ZDI credit means a ZDI advisory with more detail will likely follow; none was on the published index when read this sweep.

Am I affected?

# Toolkit version; 1.0 to 1.8.0 is affected by CVE-2026-65145, 1.4 to 1.6 by CVE-2026-65151
pip show nvidia-nat 2>/dev/null | grep -i ^version
pip index versions nvidia-nat | head -1     # 1.9.0 on 2026-10-28
grep -rn 'nvidia-nat\|nvidia_nat' requirements*.txt pyproject.toml uv.lock 2>/dev/null

# Is a toolkit server listening where anyone can reach it?
ss -ltnp 2>/dev/null | grep -E 'nat |python'

Because the vendor names no component, every exposed toolkit server on an affected version is in scope.

If you are affected

Upgrade to 1.9.0 or later. Then, for a server that was reachable from outside its trust boundary on 1.8.0 or earlier, treat the credentials its environment held (model-provider keys, tool credentials, anything in its config) as exposed and rotate them, and review the logs the server kept for calls that no authenticated user made. if your local AI agent was exploited and rotating cloud credentials.

Prevention

  • Put an authenticating layer in front of any agent server, whatever the framework says about its own authentication.
  • Track the framework's releases, not a pin: the fix here was public seven weeks before the advisory.
  • agent-sandboxing and credential-hygiene.

Sources