CVE Catalog

CVE-2026-24231

MediumCVSS 6.3
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.13%

3th percentile - higher than 3% of all known CVEs

Summary

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit may lead to information disclosure.

Risk Assessment

An attacker could force the server to make requests to internal resources, potentially resulting in information disclosure. The risk applies to environments where NemoClaw configuration is controlled by untrusted sources.

Recommendation

Update NVIDIA NemoClaw to a version with the endpoint validation fix. Restrict the ability to modify blueprint files and CLI flags to trusted operators.

Other vulnerabilities in NVIDIA NemoClaw

See all
Original NVD description (English source)

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS