NVIDIA fixes critical no-login flaw in NeMo Agent Toolkit; update to 1.9.0

NVIDIA has disclosed a critical flaw in its open-source NeMo Agent Toolkit, rated 10.0 out of 10, that lets an attacker who can reach the software over the network skip authentication and potentially run code on the host (CVE-2026-65145). Versions 1.0 through 1.8.0 are affected. Teams that build or host agents with the toolkit should update to version 1.9.0 or later and make sure its services are not exposed to untrusted networks.

What happened, in plain English

An AI agent is a program that uses a large language model (LLM) to decide what to do next and then does it: calling tools, querying databases, reading files. NVIDIA NeMo Agent Toolkit is a Python library for building, connecting, profiling and monitoring such agents. It works alongside popular agent frameworks such as LangChain, LlamaIndex and CrewAI, and it can publish a finished agent as a network service, for example as a web API or as an MCP (Model Context Protocol) server that other AI assistants can call.

On October 27, 2026, NVIDIA published a security bulletin for two flaws in the toolkit. The serious one, CVE-2026-65145, is what NVIDIA calls "missing authentication": a function that should only be usable by trusted callers does not check who is calling. Picture an office building where the front door has a badge reader, but a side door that leads to the server room was never fitted with a lock. Anyone who finds that door can walk in.

NVIDIA says a successful attack "might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure". In practice, an agent host usually holds API keys for model providers and access to whatever tools the agent uses, so a takeover reaches further than one machine.

The second flaw, CVE-2026-65151, is a SQL injection (a way of smuggling database commands through input that should be treated as plain data). It is rated 8.4 and needs local access.

NVIDIA has not said which component contains the missing check. As of November 5, 2026, no public report of attacks has appeared: NVIDIA reports none, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), in an assessment added to the CVE record on November 4, lists exploitation as "none" while rating the flaw as automatable with "total" technical impact.

Are you affected? What to do now

Who is affected

• Anyone running NVIDIA NeMo Agent Toolkit (Python package nvidia-nat) versions 1.0 through 1.8.0: CVE-2026-65145, CVSS 10.0. Fixed in 1.9.0.
• Versions 1.4 through 1.6: also CVE-2026-65151, CVSS 8.4. Fixed in 1.7.0, so 1.9.0 covers both.
• The bulletin lists all platforms. This is software you install and run yourself; the bulletin does not mention a hosted NVIDIA service.
• If nobody in your organization builds AI agents in Python with NVIDIA's tooling, you have nothing to do.

Checklist

• Find installs. On developer machines, build servers and container images, run pip show nvidia-nat (or uv pip show nvidia-nat). Also search lockfiles and requirements files for nvidia-nat, since the toolkit ships as several nvidia-nat-* plugin packages.
• Update. Upgrade to 1.9.0 or later. Version 1.9.0 has been on the Python Package Index (PyPI) since September 10, 2026, so many teams can patch immediately. Rebuild and redeploy any container images that bundle an older version.
• Check exposure. List running toolkit services and what address they listen on. By default, its MCP servers and its A2A (agent-to-agent) server bind to localhost. Services started with --host 0.0.0.0, or published through Docker or a load balancer, are reachable from the network and should be patched first.
• If you cannot patch today, keep toolkit services on localhost or behind a firewall or an authenticating reverse proxy.
• If an older version was reachable from untrusted networks, treat the host as possibly compromised: review logs for unexpected requests and processes, and rotate the credentials the agent held (LLM provider keys, database passwords, cloud tokens).
• Plan ahead. NVIDIA marked the toolkit as deprecated in October 2026 and says it reaches end of life by the end of 2026. Its documentation points to NeMo Relay, NeMo Fabric and NeMo Helix as alternatives. Updating fixes this flaw, but a migration plan is needed regardless.

NVIDIA has not published indicators of compromise (IOCs) for these flaws.

The expert view

CWE-306 (Missing Authentication for Critical Function) is one of the least exotic bug classes there is, and that is the point. The score comes from the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no credentials, no user interaction, and a "changed scope", meaning the impact extends beyond the vulnerable component, here plausibly to the host and to systems the agent's credentials reach.

The bulletin says nothing about the root cause or which interface is affected. The toolkit exposes several network-facing surfaces: a FastAPI web front end, two MCP server runtimes, an A2A server and debug routes. Its own documentation notes that its SSE (Server-Sent Events) MCP transport does not support authentication and should only be used on localhost or behind an authenticating proxy. It is not confirmed whether any of these is the flaw NVIDIA fixed. Version 1.9.0's release notes mention preflight authentication and the removal of a local_sandbox component, but NVIDIA does not link either change to the CVE, and we do not.

The pattern matches recent cases in this space: OpenHands' agent SDK, AWS Multi Model Server and several MCP servers all shipped network services whose authentication was missing or off by default. Agent tooling is often built for a developer laptop and then moved into containers and shared clusters, where "only localhost can reach it" no longer holds. An agent host is also an unusually valuable target: it is designed to run tools and holds keys to model providers and data stores.

Severity in context. A 10.0 is a worst-case score. NVIDIA itself notes its rating is "an average of risk across a diverse set of installed systems". For a toolkit service bound to localhost on a single-user workstation, the real-world risk is much lower. For one exposed on a shared network or the internet, the 10.0 is fair. The SQL injection's 8.4 assumes local access and matters mostly in shared environments.

Timeline. The fixed release went to PyPI on September 10, 2026, about seven weeks before the bulletin. That gave diligent teams a head start, but also means the fix has been public long enough for anyone comparing versions to look for the change.

Still unknown: the affected component, whether default configurations are exploitable, whether a proof of concept exists, and whether the bug has been used in attacks. NVIDIA reports none and, as of November 5, 2026, we found no public report of exploitation. The bulletin credits Colin McDonough of 50words.com and YJK (@YJK0805) of ZUSO ART, the latter reporting through the TrendAI Zero Day Initiative; no ZDI advisory with more technical detail had appeared by November 5.

Official sources

• NVIDIA Security Bulletin: NeMo Agent Toolkit – October 2026 (bulletin 5912) — published October 27, 2026
• CVE-2026-65145 record · NVD entry
• CVE-2026-65151 record
• nvidia-nat on PyPI (release history)
• NeMo Agent Toolkit release notes
• NeMo Agent Toolkit deprecation notice (pull request #2437)
• NeMo Agent Toolkit MCP server documentation
• Coverage: SecurityOnline — NVIDIA NeMo Agent Toolkit vulnerability CVE-2026-65145 scores CVSS 10.0
• Coverage: CVE Brief — October 28, 2026