# CVE-2026-24231: NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker…

Source: https://junglewise.ai/threats/cve-2026-24231-nvidia-nemoclaw-contains-a-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28  
License: CC BY 4.0 with a link back

CVE-2026-24231 · Severity: medium · CVSS 6.3 · Published 2026-04-28

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.

Technologies: [Nvidia Nemoclaw](https://junglewise.ai/threats/technologies/nemoclaw). Vendors: [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-24231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24231 being exploited in the wild.

**How severe is CVE-2026-24231?** Medium severity, with a CVSS score of 6.3, published 28 April 2026.

**Which products and versions are affected?** Nvidia Nemoclaw. The advisory does not name versions.

**Is there a fix for CVE-2026-24231?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-24231?** Check whether you run Nvidia Nemoclaw. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Nvidia Nemoclaw

## Related threats

- [NVIDIA NemoClaw inference server authentication bypass](https://junglewise.ai/threats/cve-2026-65105-nvidia-nemoclaw-inference-server-authentication-bypass)
- [NVIDIA NemoClaw command-line interface OS command injection](https://junglewise.ai/threats/cve-2026-65099-nvidia-nemoclaw-command-line-interface-os-command-injection)
- [NVIDIA NemoClaw remote-access authentication bypass](https://junglewise.ai/threats/cve-2026-65098-nvidia-nemoclaw-remote-access-authentication-bypass)
- [NVIDIA NemoClaw Linux installation script code download without integrity check](https://junglewise.ai/threats/cve-2026-65097-nvidia-nemoclaw-linux-installation-script-code-download-without)
- [NVIDIA NemoClaw command injection in Telegram bridge](https://junglewise.ai/threats/cve-2026-65096-nvidia-nemoclaw-command-injection-in-telegram-bridge)