# CVE-2026-65096: NVIDIA NemoClaw command injection in Telegram bridge

Source: https://junglewise.ai/threats/cve-2026-65096-nvidia-nemoclaw-command-injection-in-telegram-bridge  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65096 · Severity: high · CVSS 7.8 · Published 2026-08-25

NVIDIA NemoClaw is a software component for Linux that includes a Telegram integration module. An attacker could exploit a command injection flaw in the Telegram bridge to execute arbitrary OS commands, potentially leading to system compromise, data theft, or privilege escalation on affected systems.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Nvidia Nemoclaw](https://junglewise.ai/threats/technologies/nemoclaw). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-65096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65096 being exploited in the wild.

**How severe is CVE-2026-65096?** High severity, with a CVSS score of 7.8, published 25 August 2026.

**Which products and versions are affected?** Nvidia Nemoclaw <UNKNOWN>.

**Is there a fix for CVE-2026-65096?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65096 attacked?** It is attacked with local access or over the network, in a hosted service.

**Am I affected by CVE-2026-65096?** Check whether you run Linux Kernel or Nvidia Nemoclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw located in the Telegram bridge component of NVIDIA NemoClaw for Linux. The root cause is likely improper sanitization or validation of user-supplied input that is passed to system command execution functions. An attacker with local access or the ability to send messages through the Telegram bridge could inject malicious OS commands that would be executed with the privileges of the NemoClaw process. A successful exploit could result in arbitrary code execution, privilege escalation, information disclosure, and data tampering. Patches are expected to be available through NVIDIA's security advisory channels.

## Affected products

- NVIDIA NemoClaw <UNKNOWN>

## Timeline

- 2026-08-25: disclosed

## References

- [https://github.com/NVIDIA/product-security/tree/main/2026/5872](https://github.com/NVIDIA/product-security/tree/main/2026/5872)
- [https://www.cve.org/CVERecord?id=CVE-2026-65096](https://www.cve.org/CVERecord?id=CVE-2026-65096)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)