NVIDIA NeMo Agent Toolkit Patches Two October CVEs

What changed

NVIDIA published security bulletin 2026/5912 on 27 October 2026 for NeMo Agent Toolkit. Two CVEs require upgrades. CVE-2026-65145 is rated critical with a 10.0 base score for missing authentication that could lead to code execution and privilege escalation. CVE-2026-65151 is rated high for SQL injection with an 8.4 score.

Fixed versions are 1.9.0 for the authentication issue covering releases 1.0 through 1.8.0, and 1.7.0 for the SQL issue covering 1.4 through 1.6.

Why it matters

Agent toolkits sit on the path between LLM planners and enterprise data stores. Missing authentication on agent endpoints turns a network reachable service into a remote control plane. SQL injection in the same stack can exfiltrate or corrupt workflow databases that store prompts, tools, and customer metadata.

Teams rolling out agent demos on early NeMo Agent Toolkit builds may have exposed services before GPU chat traffic even went live.

Who is affected

MLOps and security engineers deploying NeMo Agent Toolkit in customer support, copilot, or internal automation pilots. Cloud architects should scan images for versions below 1.9.0. Compliance teams must map the critical CVE to change windows even when agents are internal only.

What to do next

Inventory running instances and upgrade to 1.9.0 or later from the NeMo-Agent-Toolkit GitHub repository. For SQL injection exposure on older 1.4 to 1.6 lines, minimum version 1.7.0 applies. Re run authentication tests on any tool server that was internet reachable during testing.

What to watch

Watch NVIDIA product security pages for additional agent framework advisories. Track whether downstream vendors rebadge NeMo Agent Toolkit under custom product names without publishing their own security notices.

Photo: RDNE Stock project / Pexels

NVIDIA risk text notes assessments average across installations and may not match local exposure.

Photo: cottonbro studio / Pexels

Agent frameworks often ship quickly because demos win deals. Authentication gaps are common when samples bind to localhost only during development. Moving the same container to a subnet without auth wraps an LLM planner around open admin APIs.

SQL injection in toolkit databases can leak prompt templates, API keys stored in workflow tables, or customer identifiers. Even internal pilots deserve parameterized queries and network segmentation.

After upgrading, rerun dynamic scans on any endpoint that accepts tool registration uploads. Verify logs show denied anonymous calls instead of silent success on sensitive routes.

Agents call tools the way humans click admin panels. If anyone on the internet can reach those tools, you have a remote admin hole. Patch quickly even if the demo looked fine on a laptop.

Keep a single owner for agent server versions. Shadow IT deploys are common in AI pilots. Central tracking prevents one team from running 1.5 while another runs 1.9.

Block agent admin ports at the firewall by default. Allow list office VPN ranges only. Public cloud images often ship with wide defaults.

Add the bulletin to your October patch calendar. Critical scores deserve same week action. Delay invites scan and exploit attempts.

Tell executives the fix is a version bump, not a new product buy. Scope stays small if inventory is accurate. Hidden dev instances are the usual miss.

Rotate API keys if agents had public exposure. Assume logs were touched. Short rotations limit blast radius.

Run a tabletop on agent abuse paths. Walk from chat UI to tool server to database. Gaps show up fast in a one hour drill.

File the bulletin ID in your ticket system. Link every upgraded host to that ID. Auditors ask for proof.

Sources

Primary — NVIDIA, NeMo Agent Toolkit security bulletin 2026/5912 (27 October 2026). Lists CVE identifiers, scores, affected versions, and fixed releases.
Secondary — National Vulnerability Database, CVE-2026-65145 record (2026). Independent CVE metadata for the authentication flaw.
Secondary — National Vulnerability Database, CVE-2026-65151 record (2026). Independent CVE metadata for the SQL injection flaw.