CVE-2026-47615 Overview
CVE-2026-47615 is a server-side request forgery (SSRF) vulnerability in NVIDIA Dynamo for Linux. An attacker can supply a crafted URL in a multimodal request to force the server to issue outbound HTTP requests to attacker-chosen destinations. Successful exploitation can result in information disclosure, including access to internal services, cloud metadata endpoints, or otherwise unreachable resources on the server's network. The flaw is remotely exploitable over the network without authentication or user interaction. NVIDIA published the advisory on August 4, 2026, and tracks the issue under bulletin 5842.
Critical Impact
Unauthenticated remote attackers can coerce NVIDIA Dynamo to fetch arbitrary URLs, exposing internal services and sensitive metadata.
Affected Products
- NVIDIA Dynamo for Linux
- Multimodal request-processing components in NVIDIA Dynamo
- See the NVIDIA product security advisory 5842 for exact version ranges
Discovery Timeline
- 2026-08-04 - CVE-2026-47615 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-47615
Vulnerability Analysis
CVE-2026-47615 is classified as Server-Side Request Forgery [CWE-918]. NVIDIA Dynamo accepts URLs inside multimodal requests, typically to fetch remote images, video, or other media referenced by an inference workload. The server dereferences these URLs without adequate validation of the scheme, host, or destination network. An attacker submits a request containing a URL that points to an internal resource. The server then issues the request on the attacker's behalf and may return response data, headers, or error information to the caller. Common SSRF targets include cloud instance metadata services, internal APIs, container orchestration endpoints, and localhost-bound admin interfaces. Because Dynamo runs in GPU-accelerated inference environments that often reside inside cloud VPCs, exposure of cloud metadata credentials is a realistic outcome.
Root Cause
The root cause is missing or insufficient allow-list validation on URL inputs supplied through multimodal request payloads. Dynamo trusts the URL provided by the client and issues an outbound HTTP request without restricting the destination to expected external content hosts. Scheme filtering, DNS rebinding protection, and blocklisting of private and link-local address ranges are not enforced correctly.
Attack Vector
The vulnerability is exploited over the network against any exposed Dynamo endpoint accepting multimodal input. The attacker sends a normal-looking inference request whose media URL field references an internal target such as http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:8080/admin. Dynamo fetches the URL server-side and, depending on the response handling path, may propagate the fetched content or metadata back to the attacker. No credentials or user interaction are required.
No public proof-of-concept code is available at the time of publication. Refer to the NVIDIA product security bulletin for technical specifics.
Detection Methods for CVE-2026-47615
Indicators of Compromise
- Outbound HTTP requests from Dynamo processes to RFC1918, link-local (169.254.0.0/16), or loopback addresses
- Multimodal request payloads containing URLs referencing internal hostnames, cloud metadata IPs, or non-HTTPS schemes such as file://, gopher://, or ftp://
- Unexpected access log entries on internal services originating from the Dynamo server's IP
- Anomalous DNS lookups from Dynamo hosts for internal-only domains
Detection Strategies
- Inspect Dynamo access logs for multimodal request fields containing URLs whose hosts resolve to private or metadata address ranges
- Correlate egress network flows from Dynamo hosts with the destination allow-list expected for legitimate media fetches
- Alert on any request originating from Dynamo to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal
Monitoring Recommendations
- Enable verbose request logging on Dynamo, capturing full URL parameters submitted in multimodal payloads
- Route Dynamo egress through an inspecting proxy that blocks private address ranges and logs destination hosts
- Monitor cloud audit logs for unexpected use of the instance role assigned to Dynamo hosts
How to Mitigate CVE-2026-47615
Immediate Actions Required
- Apply the patched NVIDIA Dynamo release referenced in NVIDIA advisory 5842
- Restrict inbound access to Dynamo endpoints to authenticated clients and trusted networks
- Rotate any cloud credentials or tokens that may have been exposed through the instance metadata service
Patch Information
NVIDIA has published fixed versions of Dynamo through its product security repository. Consult the NVIDIA product security bulletin 5842 for the exact fixed release identifiers and upgrade instructions. Verify version after upgrade and validate that multimodal URL validation is active.
Workarounds
- Force cloud instance metadata service to IMDSv2 with hop-limit 1 to reduce SSRF impact on AWS-hosted Dynamo deployments
- Deploy Dynamo behind an egress proxy that denies requests to private, loopback, and link-local address ranges
- Filter multimodal request payloads at an upstream gateway to allow only URLs matching an approved host allow-list
- Segment Dynamo hosts into a dedicated network with no route to internal management interfaces
# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner dynamo -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner dynamo -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner dynamo -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner dynamo -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner dynamo -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
