CVE-2026-65096: NVIDIA NemoClaw RCE Vulnerability

CVE-2026-65096 Overview

CVE-2026-65096 is an OS command injection vulnerability in the Telegram bridge component of NVIDIA NemoClaw for Linux. An authenticated local attacker can inject operating system commands that the bridge executes with the privileges of the running process. Successful exploitation leads to arbitrary code execution, privilege escalation, information disclosure, and data tampering. The flaw is tracked under CWE-78, which covers improper neutralization of special elements used in OS commands.

Critical Impact
An authenticated local attacker can execute arbitrary OS commands through the NemoClaw Telegram bridge, resulting in code execution, privilege escalation, information disclosure, and data tampering.

Affected Products

NVIDIA NemoClaw for Linux (Telegram bridge component)
Refer to the NVIDIA product security advisory for specific affected versions
Refer to the NVD entry for CVE-2026-65096 for updated CPE data

Discovery Timeline

2026-08-25 - CVE-2026-65096 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD

Technical Details for CVE-2026-65096

Vulnerability Analysis

The vulnerability resides in the Telegram bridge component of NVIDIA NemoClaw for Linux. The bridge processes input from Telegram messaging channels and passes attacker-controllable data into an OS command execution path without sufficient neutralization of shell metacharacters. As a result, an attacker who can reach the bridge with authenticated local access can inject commands that run under the identity of the NemoClaw process.

Exploitation results in arbitrary code execution on the host, and the attacker can leverage the initial foothold to escalate privileges, read sensitive files, and modify data managed by NemoClaw. The vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Root Cause

The root cause is unsafe construction of shell command strings from data received through the Telegram bridge. When user-supplied content is concatenated into a command invoked by a shell, characters such as ;, |, &, backticks, and $() are interpreted as shell syntax rather than literal data. Missing input validation and the absence of parameterized process invocation allow injected commands to reach the underlying shell.

Attack Vector

The attack vector is local and requires low privileges. An attacker with local access to a system running NemoClaw sends crafted input through the Telegram bridge integration. The bridge relays that input into a shell command, at which point the injected payload executes. No user interaction is required beyond the attacker's own actions, and the impact spans confidentiality, integrity, and availability.

No verified public proof-of-concept code is available at the time of writing. Refer to the NVIDIA product-security repository for the vendor's technical description.

Detection Methods for CVE-2026-65096

Indicators of Compromise

Unexpected child processes spawned by the NemoClaw Telegram bridge process, particularly shells such as /bin/sh, /bin/bash, or interpreters like python, perl, or curl.
Outbound network connections initiated by the NemoClaw process to unfamiliar hosts or command-and-control infrastructure.
Shell metacharacters (;, |, &&, `, $()) appearing in NemoClaw bridge logs or Telegram message payloads processed by the service.
New or modified files in NemoClaw working directories or user home directories that correlate with bridge activity.

Detection Strategies

Hunt for process ancestry chains where the NemoClaw bridge is the parent of shell interpreters or download utilities such as wget and curl.
Correlate Telegram bridge log entries with process execution telemetry to detect command strings containing shell control operators.
Baseline the normal command set executed by NemoClaw and alert on deviations, especially invocations of /bin/sh -c.

Monitoring Recommendations

Enable Linux auditd rules for execve calls originating from the NemoClaw service account and forward events to a centralized log store.
Monitor egress traffic from hosts running NemoClaw and alert on connections that do not match the expected NVIDIA or Telegram API endpoints.
Track integrity of configuration files and binaries associated with NemoClaw using file integrity monitoring.

How to Mitigate CVE-2026-65096

Immediate Actions Required

Apply the fixed version referenced in the NVIDIA product-security advisory for issue 5872 as soon as it is available.
Restrict local access to hosts running NemoClaw to trusted administrative accounts only.
Disable the Telegram bridge component on systems where it is not required for operations.
Rotate any credentials, tokens, or API keys that were accessible to the NemoClaw process if compromise is suspected.

Patch Information

NVIDIA publishes patch and version information for this advisory in the NVIDIA product-security GitHub repository. Consult the NVD record for CVE-2026-65096 and the CVE.org entry for the authoritative list of fixed versions once populated.

Workarounds

Disable or uninstall the Telegram bridge component until the patched release is deployed.
Run NemoClaw under a dedicated low-privilege service account with no sudo rights and a restricted shell.
Apply Linux hardening controls such as AppArmor or SELinux profiles that constrain the NemoClaw process from spawning arbitrary shells.
Filter or validate input reaching the Telegram bridge at a network or proxy layer to strip shell metacharacters where feasible.

bash

# Example: restrict the NemoClaw service via systemd hardening directives
# /etc/systemd/system/nemoclaw.service.d/hardening.conf
[Service]
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
RestrictSUIDSGID=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM