CVE-2026-47612: NVIDIA Dynamo Path Traversal Flaw

CVE-2026-47612 Overview

CVE-2026-47612 is a path traversal vulnerability in the image loading component of NVIDIA Dynamo for Linux. An attacker can supply a crafted pathname that escapes the intended restricted directory, causing the component to read files outside its expected scope. Successful exploitation may lead to information disclosure of sensitive files accessible to the Dynamo process.

The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The attack is network-reachable, requires no authentication, and needs no user interaction.

Critical Impact
Remote, unauthenticated attackers can traverse directories through the image loading component and disclose files readable by the NVIDIA Dynamo process on Linux systems.

Affected Products

NVIDIA Dynamo for Linux (image loading component)
Specific version ranges: Not Available in NVD data at time of publication
Refer to the NVIDIA product security advisory for authoritative version details

Discovery Timeline

2026-08-04 - CVE-2026-47612 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-47612

Vulnerability Analysis

The vulnerability resides in the image loading component of NVIDIA Dynamo for Linux. The component accepts a pathname input but fails to properly constrain it to a restricted directory. An attacker submits a path containing traversal sequences such as ../ to reference files outside the intended base directory.

Because the exposure is network-accessible without authentication or user interaction, any client able to reach the Dynamo image loading endpoint can trigger the flaw. The confidentiality impact is high, while integrity and availability are not affected. This aligns with a read-only information disclosure primitive, where the process returns or exposes the contents of files it can access on the host.

Sensitive targets on Linux hosts typically include configuration files, service credentials, model artifacts, private keys, and logs residing on paths readable by the Dynamo service account.

Root Cause

The root cause is missing or insufficient canonicalization and validation of user-supplied pathnames in the image loading logic. The component does not enforce that the resolved path remains within an allowed base directory before opening the file. See the NVIDIA product security advisory for vendor technical detail.

Attack Vector

An unauthenticated remote attacker sends a request to the Dynamo image loading interface with a manipulated path parameter. The path contains traversal tokens that resolve outside the restricted directory. The service opens and returns the referenced file, disclosing its contents to the attacker. No privileges or user interaction are required.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the NVD record for CVE-2026-47612 and the CVE.org entry.

Detection Methods for CVE-2026-47612

Indicators of Compromise

Requests to Dynamo image loading endpoints containing ../, ..%2f, ..%5c, or URL-encoded traversal sequences in path parameters
Access log entries showing image load requests referencing paths outside the configured image directory, such as /etc/passwd, /etc/shadow, or ~/.ssh/
Unexpected file read events by the Dynamo process against sensitive system paths
Outbound responses from Dynamo image endpoints returning non-image MIME types or unusually sized payloads

Detection Strategies

Deploy web application firewall or reverse proxy rules that block traversal patterns in requests to Dynamo endpoints
Enable file access auditing (auditd) on sensitive directories and correlate reads with the Dynamo process ID
Monitor Dynamo application logs for path resolution errors, permission denials, or requests referencing absolute paths
Baseline normal image-loading paths and alert on deviations that reference directories outside the configured content root

Monitoring Recommendations

Ingest Dynamo access and application logs into a centralized SIEM for pattern-based hunting on traversal signatures
Alert on any process spawned by Dynamo that reads files outside its designated data directory
Track network egress from hosts running Dynamo for unusual response sizes tied to image endpoints
Review CWE-22 detection rules in existing IDS/IPS signatures and confirm coverage against encoded traversal variants

How to Mitigate CVE-2026-47612

Immediate Actions Required

Apply the fixed release referenced in the NVIDIA product security advisory as soon as it is available for your environment
Restrict network exposure of Dynamo image loading endpoints to trusted internal segments until patched
Audit the file system permissions of the account running Dynamo and remove read access to sensitive files where feasible
Review recent access logs for traversal patterns dating back to the earliest deployment of the affected component

Patch Information

NVIDIA has published tracking for this issue in its product security repository. Refer to the NVIDIA advisory for entry 5842 for the fixed version, upgrade instructions, and vendor-provided remediation guidance. Confirm the installed Dynamo version against the fixed version listed in that advisory before considering remediation complete.

Workarounds

Place a reverse proxy in front of Dynamo and reject requests containing .., %2e%2e, or absolute path prefixes in image parameters
Run the Dynamo service under a dedicated low-privilege user with a chroot or filesystem namespace limiting reachable files
Use mandatory access control (SELinux or AppArmor) profiles to constrain Dynamo file reads to the designated image directory
Disable or firewall the image loading endpoint if it is not required for production workloads

bash

# Example AppArmor snippet restricting Dynamo file access to /var/lib/dynamo/images
/usr/bin/dynamo {
  # Deny reads outside the sanctioned image directory
  deny /etc/** r,
  deny /root/** r,
  deny /home/**/.ssh/** r,

  # Allow only the intended image content root
  /var/lib/dynamo/images/** r,
}