CVE-2026-65087: NVIDIA NemoClaw Information Disclosure

CVE-2026-65087 is an information disclosure flaw in NVIDIA NemoClaw caused by insufficiently protected credentials. Attackers can exploit this to access sensitive data and tamper with information. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-65087 Overview

CVE-2026-65087 affects NVIDIA NemoClaw and stems from insufficiently protected credentials [CWE-522]. A local, low-privileged attacker can access sensitive credential material when a user is induced to perform an interaction. Successful exploitation can lead to information disclosure and data tampering within the affected environment.

The issue carries a CVSS 3.1 score of 5.6 (Medium). The attack vector is local and requires both low privileges and user interaction. Confidentiality impact is high, while integrity impact is low and availability is unaffected.

Critical Impact
An authenticated local user can retrieve protected credentials from NVIDIA NemoClaw and use them to disclose sensitive data or tamper with information the credentials can access.

Affected Products

NVIDIA NemoClaw (specific affected versions not enumerated in the NVD record)
Refer to the NVIDIA Security Repository for vendor-published version details
Consult the NVD CVE-2026-65087 Details for updates as CPE data is published

Discovery Timeline

2026-08-25 - CVE-2026-65087 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65087

Vulnerability Analysis

CVE-2026-65087 is classified under [CWE-522]: Insufficiently Protected Credentials. NVIDIA NemoClaw stores or transmits authentication material without adequate protection. A local attacker with limited privileges can access this credential data once a legitimate user performs a required interaction.

Once recovered, the credentials extend the attacker's reach to any resource or interface those secrets authorize. This produces high confidentiality impact and enables limited data tampering on associated systems.

Root Cause

The root cause is inadequate protection of credential storage or handling in NemoClaw. Common patterns in [CWE-522] findings include plaintext credential storage, weak file permissions on credential files, credentials cached in accessible locations, or exposure through logs and configuration artifacts. NVIDIA has not published root-cause specifics in the public advisory beyond the weakness classification.

Attack Vector

Exploitation requires local access to the host running NemoClaw and an authenticated user with low privileges. The attacker must also rely on a legitimate user completing an interaction that exposes the credential state. Because the scope is unchanged, the compromise is bounded by the privileges the recovered credentials grant.

No public proof-of-concept exists at the time of publication. The EPSS score of 0.101% indicates a low modeled likelihood of exploitation in the near term. Refer to the NVIDIA Security Repository for authoritative exploitation prerequisites.

Detection Methods for CVE-2026-65087

Indicators of Compromise

Unexpected reads of NemoClaw configuration files, token caches, or credential stores by non-service accounts.
Access to NemoClaw process memory or debug interfaces from local user contexts.
Downstream authentication events using NemoClaw service credentials from unusual endpoints or times.

Detection Strategies

Monitor file access telemetry for NemoClaw credential paths and flag reads by users outside the service account.
Correlate local user sessions with subsequent use of NemoClaw-issued tokens or API keys across systems.
Alert on privilege-adjacent behaviors such as credential enumeration tools executing on hosts running NemoClaw.

Monitoring Recommendations

Enable command-line and file-access auditing on all systems hosting NemoClaw components.
Forward NemoClaw application, authentication, and OS audit logs to a centralized analytics platform for retention and correlation.
Baseline normal credential-access patterns for NemoClaw and generate alerts on deviations.

How to Mitigate CVE-2026-65087

Immediate Actions Required

Inventory all systems running NVIDIA NemoClaw and identify accounts with local access to those hosts.
Apply the security update referenced in the NVIDIA Security Repository as soon as it is available for your version.
Rotate any credentials, API keys, or tokens that NemoClaw stored or handled prior to patching.
Restrict local login rights on NemoClaw hosts to required administrators and service accounts.

Patch Information

NVIDIA has published this advisory in its product security repository. Consult the NVIDIA Security Repository for fixed versions, patch identifiers, and upgrade instructions. Track the CVE Record CVE-2026-65087 for revisions.

Workarounds

Enforce least privilege on NemoClaw hosts and remove interactive login for non-essential users until patched.
Store NemoClaw credentials in an external secrets manager where supported, and disable local caching options.
Restrict filesystem permissions on NemoClaw configuration and credential directories to the service account only.
Require multi-factor authentication on any downstream service that accepts NemoClaw-issued credentials to blunt reuse.