CVE-2026-47613 Overview
CVE-2026-47613 affects NVIDIA Dynamo running on Linux. The vulnerability allows an attacker to bypass path restrictions by supplying a crafted local path within a multimodal request. Successful exploitation can lead to information disclosure through unauthorized file access on the target system.
The flaw is network-reachable and requires no authentication or user interaction. It is classified under CWE-918, reflecting improper validation of attacker-supplied resource identifiers. NVIDIA published details through its product-security repository.
Critical Impact
A remote unauthenticated attacker can retrieve sensitive files by manipulating pathname parameters in multimodal requests processed by NVIDIA Dynamo.
Affected Products
- NVIDIA Dynamo for Linux
- Multimodal request handling components within NVIDIA Dynamo
- Deployments exposing Dynamo endpoints to untrusted network clients
Discovery Timeline
- 2026-08-04 - CVE-2026-47613 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-47613
Vulnerability Analysis
NVIDIA Dynamo processes multimodal requests that reference local resources by path. The application fails to properly restrict pathnames to an intended directory. An attacker supplies a crafted path containing traversal sequences or references outside the expected resource root. The server resolves the attacker-controlled path and returns the contents to the requester.
The flaw maps to path traversal behavior even though it is tracked as CWE-918 (Server-Side Request Forgery). Either classification reflects the underlying issue: user-supplied resource identifiers reach a file or URL fetch operation without adequate validation. The scope is limited to confidentiality, with no integrity or availability impact recorded.
Root Cause
The root cause is missing or insufficient canonicalization of pathname arguments received through the multimodal request interface. Dynamo accepts a path parameter and passes it to a file access routine without confirming that the resolved path stays within an allowed directory. Attackers exploit this by embedding relative traversal segments or absolute paths that reference sensitive files.
Attack Vector
Exploitation requires network access to a Dynamo endpoint that accepts multimodal requests. The attacker crafts a request whose local-path field points at a file outside the intended asset directory. Dynamo reads the referenced file and returns its content in the response or in downstream processing output. No credentials or user interaction are required. See the NVIDIA product security advisory and the NVD entry for authoritative technical details.
No public proof-of-concept code has been released for CVE-2026-47613 at the time of publication.
Detection Methods for CVE-2026-47613
Indicators of Compromise
- Multimodal API requests containing ../ sequences, absolute paths, or file URI schemes in local-path parameters
- Dynamo server logs showing successful reads of files outside the configured asset or model directory
- Response payloads containing content from system files such as /etc/passwd, configuration files, or private keys
- Anomalous outbound data volume from Dynamo host processes correlated with inbound multimodal requests
Detection Strategies
- Inspect application-layer logs for path parameters containing traversal characters, encoded variants (%2e%2e%2f), or unexpected absolute paths
- Enable file access auditing on the Dynamo host and alert on reads outside the designated asset directory by the Dynamo service account
- Deploy network signatures on reverse proxies or web application firewalls that flag multimodal request bodies with suspicious path values
Monitoring Recommendations
- Forward Dynamo application logs and Linux auditd file-access events to a centralized analytics platform for correlation
- Baseline normal file read patterns for the Dynamo service account and alert on deviations
- Monitor request rates and response sizes on multimodal endpoints for anomalies consistent with data exfiltration
How to Mitigate CVE-2026-47613
Immediate Actions Required
- Apply the fixed version referenced in the NVIDIA product security advisory as soon as it is available for your deployment
- Restrict network access to Dynamo endpoints so that only trusted clients can submit multimodal requests
- Run the Dynamo process under a dedicated low-privilege service account with read access limited to required asset directories
- Review historical logs for evidence of path traversal attempts against multimodal endpoints
Patch Information
Refer to the NVIDIA product security bulletin at github.com/NVIDIA/product-security/tree/main/2026/5842 for the fixed release, upgrade guidance, and any interim vendor recommendations. Track the CVE record for updates.
Workarounds
- Place Dynamo behind a reverse proxy that validates and normalizes path parameters before forwarding requests
- Enforce Linux file system controls, such as mandatory access control profiles or filesystem namespaces, that constrain the Dynamo process to its asset directory
- Reject multimodal requests whose local-path field contains .., absolute paths, or non-standard URI schemes at the application boundary
# Example: constrain the Dynamo systemd unit to its asset directory
# /etc/systemd/system/dynamo.service.d/hardening.conf
[Service]
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/opt/dynamo
ReadWritePaths=/var/lib/dynamo
InaccessiblePaths=/etc/shadow /root
NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
