CVE-2026-65099: NVIDIA NemoClaw RCE Vulnerability

CVE-2026-65099 Overview

CVE-2026-65099 is an operating system (OS) command injection vulnerability in the NVIDIA NemoClaw command-line interface (CLI) for Linux. An authenticated local attacker can inject arbitrary OS commands through the CLI, causing the underlying shell to execute attacker-controlled input. The weakness is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Successful exploitation can lead to code execution, data tampering, information disclosure, and denial of service on the affected host. Because exploitation requires local access with low privileges, the vulnerability primarily serves as a privilege escalation and lateral movement primitive on shared or multi-user Linux systems.

Critical Impact
Local low-privileged users can execute arbitrary OS commands through the NemoClaw CLI, resulting in confidentiality, integrity, and availability loss on the affected Linux host.

Affected Products

NVIDIA NemoClaw for Linux (command-line interface component)
Specific fixed versions are documented in the NVIDIA product-security advisory
No CPE URIs have been published in the NVD entry for CVE-2026-65099 at the time of writing

Discovery Timeline

2026-08-25 - CVE-2026-65099 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65099

Vulnerability Analysis

The flaw resides in how the NemoClaw CLI on Linux processes user-supplied arguments before passing them to an underlying OS shell. Input strings are not properly neutralized, allowing shell metacharacters such as ;, |, &, backticks, and $(...) to break out of the intended command context. This is a classic OS command injection pattern captured by CWE-78.

An attacker who can invoke the NemoClaw CLI on a target Linux system can craft an argument that terminates the intended command and appends an arbitrary shell payload. The injected command runs with the privileges of the NemoClaw CLI process. Impacts include arbitrary code execution, tampering with NemoClaw configuration or model data, disclosure of files readable by the process, and denial of service through resource-consuming or destructive commands.

Root Cause

The root cause is unsafe construction of shell command strings from untrusted CLI input. Rather than passing arguments as a fixed argument vector to a safe execution API, the CLI concatenates user input into a string that is then interpreted by a shell. Any shell metacharacter in the input is honored by the interpreter, producing the injection.

Attack Vector

The attack vector is local (AV:L) and requires low privileges (PR:L) with no user interaction. A local user account with permission to invoke the NemoClaw CLI supplies a malicious argument that embeds shell metacharacters. When the CLI forwards this argument to the shell, the attacker's payload executes in the process context. On systems where NemoClaw is invoked by a higher-privileged user or wrapped in a sudo rule, this primitive can be chained for privilege escalation.

No verified public exploit code or proof-of-concept has been published for CVE-2026-65099 at the time of writing. Refer to the NVIDIA product-security advisory for authoritative technical detail.

Detection Methods for CVE-2026-65099

Indicators of Compromise

Unexpected child processes of the NemoClaw CLI process, especially /bin/sh, /bin/bash, python, curl, wget, or nc
Shell metacharacters (;, |, &&, backticks, $( )) observed in NemoClaw CLI command-line arguments in audit logs
Outbound network connections initiated from the NemoClaw process to unfamiliar destinations
New or modified files under NemoClaw configuration or model directories that do not correspond to legitimate operator activity

Detection Strategies

Enable Linux auditd rules on execve to capture full command lines for NemoClaw and its descendants, then hunt for shell metacharacters within arguments
Correlate process ancestry: alert when the NemoClaw CLI spawns interactive shells, package managers, or network utilities that fall outside its documented behavior
Baseline normal NemoClaw invocations per user and flag deviations in argument length, character class, or downstream syscalls

Monitoring Recommendations

Forward auditd, execve, and shell history telemetry to a centralized analytics platform for retention and search
Monitor for privilege transitions where a lower-privileged user's NemoClaw invocation results in higher-privileged child processes
Track file integrity on NemoClaw binaries, configuration files, and any wrapper scripts referenced from sudoers

How to Mitigate CVE-2026-65099

Immediate Actions Required

Apply the fixed version of NVIDIA NemoClaw for Linux as documented in the NVIDIA product-security advisory
Inventory all Linux hosts running NemoClaw and prioritize multi-user systems, shared GPU nodes, and CI/CD runners
Review sudoers and setuid configurations that allow non-administrative users to invoke NemoClaw with elevated privileges, and remove or tighten those rules until patching is complete
Restrict CLI access to a minimal set of trusted operator accounts

Patch Information

NVIDIA has published remediation guidance and fixed version details in the NVIDIA product-security repository entry for advisory 5872. Administrators should consult that advisory and the CVE.org record for CVE-2026-65099 for authoritative version numbers before deploying updates. Patch through the standard NVIDIA distribution channel used to install NemoClaw in the environment.

Workarounds

Limit execution of the NemoClaw CLI to trusted administrators until the patch is applied, using file permissions or role-based access controls
Remove the NemoClaw binary from shared or interactive login hosts where non-administrative users have shell access
Wrap NemoClaw invocations in vetted scripts that validate arguments against a strict allowlist and reject shell metacharacters
Enforce mandatory access controls such as SELinux or AppArmor profiles to constrain the NemoClaw process's ability to spawn arbitrary child processes

bash

# Example AppArmor-style restriction concept for the NemoClaw binary
# Replace /usr/local/bin/nemoclaw with the actual installed path
/usr/local/bin/nemoclaw {
    # Deny execution of common shells and network tools
    deny /bin/sh x,
    deny /bin/bash x,
    deny /usr/bin/curl x,
    deny /usr/bin/wget x,
    deny /usr/bin/nc x,
}