# CVE-2026-65105: NVIDIA NemoClaw inference server authentication bypass

Source: https://junglewise.ai/threats/cve-2026-65105-nvidia-nemoclaw-inference-server-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65105 · Severity: high · CVSS 8.1 · Published 2026-08-25

NVIDIA NemoClaw for Linux is a machine learning inference platform used to deploy AI models. The inference server can be accessed by remote attackers without authentication, allowing them to extract sensitive model data, inference inputs/outputs, and disrupt service availability.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Nvidia Nemoclaw](https://junglewise.ai/threats/technologies/nemoclaw). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Nvidia](https://junglewise.ai/threats/vendors/nvidia).

## Quick answers

**Is CVE-2026-65105 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65105 being exploited in the wild.

**How severe is CVE-2026-65105?** High severity, with a CVSS score of 8.1, published 25 August 2026.

**Which products and versions are affected?** Nvidia Nemoclaw <UNKNOWN>.

**Is there a fix for CVE-2026-65105?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65105 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65105?** Check whether you run Linux Kernel or Nvidia Nemoclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

NVIDIA NemoClaw for Linux contains an authentication bypass vulnerability in its inference server setup. The vulnerability allows remote attackers to access the inference service without credentials, bypassing the intended authentication mechanism. Successful exploitation can lead to information disclosure (exposure of models, inference data, and system information) and denial of service through resource exhaustion or service disruption. The vulnerability is network-reachable and requires no prior authentication or user interaction. Patches are expected from NVIDIA.

## Affected products

- NVIDIA NemoClaw <UNKNOWN>

## Timeline

- 2026-08-25: disclosed

## References

- [https://github.com/NVIDIA/product-security/tree/main/2026/5872](https://github.com/NVIDIA/product-security/tree/main/2026/5872)
- [https://www.cve.org/CVERecord?id=CVE-2026-65105](https://www.cve.org/CVERecord?id=CVE-2026-65105)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)