NVIDIA NeMo Agent Toolkit SQL injection (CVE-2026-65151)
NVIDIA NeMo Agent Toolkit is vulnerable to a SQL injection flaw that may allow an unauthorized attacker to perform data tampering, cause a denial of service, or facilitate unauthorized information disclosure.
CVE search metadata
CVE search record: CVE-2026-65151. Severity: high. CVSS: 8.4. KEV: no. Product: NeMo Agent Toolkit. Brief: NVIDIA NeMo Agent Toolkit SQL injection (CVE-2026-65151). Brief link: https://feed.craftedsignal.io/briefs/2026-10-nvidia-nemo-sql-injection/
Triage facts
Revision 1- Applicability
- NeMo Agent Toolkit
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 13:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
NVIDIA has disclosed a vulnerability in the NeMo Agent Toolkit that allows for SQL injection (CVE-2026-65151). Successful exploitation can lead to unauthorized data tampering, denial of service, and information disclosure. No specific version ranges or remediation steps were provided in the initial NVD advisory; organizations should monitor NVIDIA for patch releases.
Impact
Successful exploitation may result in data tampering, denial of service (DoS), and information disclosure.
Recommendation
- Monitor NVIDIA security advisories for patches addressing CVE-2026-65151.
- Inventory all instances of NVIDIA NeMo Agent Toolkit in your environment.
- Implement strict input validation and parameterized queries for web interfaces interacting with the toolkit until a patch is applied.
Immediate actions
Inventory all NeMo Agent Toolkit deployments for rapid patching when a vendor update is released
Threat Hunt
Monitor web access logs for common SQL injection patterns targeting toolkit-specific endpoints
Data: Web application logs, WAF logs
Mitigations
Apply security patches or configuration changes provided by NVIDIA once released
CVE-2026-65151