home / blog
2026-10-30 · critical
CVE-2026-65145: Missing Authentication in NVIDIA NeMo Agent
Missing authentication in NVIDIA NeMo. CVSS 10.0 critical. Affected versions 1.0-1.8.0, patch 1.9.0.
CVE-2026-65145 affects NVIDIA NeMo Agent Toolkit, a library for developing AI agents, and stems from missing authentication controls. The vulnerability allows an attacker to cause arbitrary code execution, privilege escalation, data tampering, denial of service, and information disclosure.
This vulnerability is rated critical with a CVSS score of 10.0. Affected versions range from 1.0 to 1.8.0. NVIDIA released a security patch in version 1.9.0 on October 27, 2026. No public GitHub exploits for this CVE have been identified.
Administrators and IT teams should prioritize updating NVIDIA NeMo Agent Toolkit to version 1.9.0 or later. If immediate patching is not possible, implement access restrictions and environmental isolation of the toolkit. Monitor access logs to detect unauthorized system usage.
At a glance
- What
- CVE-2026-65145: missing authentication controls in NVIDIA NeMo Agent Toolkit enabling code execution, privilege escalation, data tampering, denial of service, and information disclosure.
- Severity
- Critical - CVSS 10.0
- Affected versions
- NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0
- Fix
- Update to version 1.9.0 or later
- Status
- Patch released October 27, 2026. No public GitHub exploits identified.
- Action
- Immediately update to version 1.9.0. If not possible, apply access restrictions and environmental isolation.
Sources: NVD, CVE-2026-65145