NVIDIA has patched CVE-2026-65145, a maximum-severity missing-authentication flaw in its NeMo Agent Toolkit, along with five other vulnerabilities across NeMo Agent Toolkit, TensorRT-LLM and PhysX. The company issued the security update on October 27 and reports no exploitation.
How CVE-2026-65145 Exposes the NeMo Agent Toolkit
The flaw is rated CVSS 10.0 and classified as CWE-306, missing authentication for a critical function. A remote, unauthenticated attacker can exploit it to gain code execution. The list of consequences also includes privilege escalation, data tampering, denial of service and information disclosure.
Why Missing Authentication Scores a 10.0
The score reflects what an attacker needs: network access and nothing else. With no credentials required and code execution as the outcome, the vulnerability meets the conditions for the top of the CVSS scale. The impact assessment for the release states that AI agent deployments exposing the toolkit could be fully taken over.
The Five Other Vulnerabilities in the Update
NVIDIA’s update fixes five further flaws. CVE-2026-65151 is an SQL injection in the NeMo Agent Toolkit, scored 8.4. CVE-2026-65119 also scores 8.4. CVE-2026-47486 is an out-of-bounds write scored 7.8. CVE-2026-65120 and CVE-2026-24269 are server-side request forgery flaws, each scored 7.1.
SQL Injection and Request Forgery in the Agent Stack
The SQL injection and the request forgery entries cover different parts of the software stack than the headline flaw. Server-side request forgery lets an attacker make a server issue requests on their behalf, while the SQL injection targets the data layer of the toolkit. Together with CVE-2026-65145 they put the NeMo Agent Toolkit at the center of the update.
NeMo Agent Toolkit 1.9.0 and TensorRT-LLM 1.3.0rc25 Fixes
The fixes are in NeMo Agent Toolkit 1.9.0 and TensorRT-LLM 1.3.0rc25. NVIDIA’s reporting does not identify a patched PhysX version in the material available for this article, although PhysX is named among the affected products.
No Reported Exploitation of the NeMo Agent Toolkit Flaw
No exploitation has been reported. The vulnerability class is simple to describe and does not depend on chaining with other bugs, which affects how quickly attackers could build a working attack once details are public.
The toolkit is used to build and run AI agents, software that acts on instructions and connects to other systems. Taking over an agent deployment can therefore reach beyond the single process to the services and data the agent is permitted to use. The source material does not enumerate those downstream effects, so their extent depends on how each organization has configured its agents.
Position of the Release Among AI Infrastructure Bugs
The update continues a run of maximum-severity flaws in AI infrastructure software disclosed in recent weeks, including the LiteLLM proxy vulnerability patched the same day. Tools that orchestrate models and agents are being built quickly, and authentication and input handling checks are among the controls security researchers are finding missing.
A CWE-306 flaw is an omission rather than a subtle logic error: a function that should require authentication does not. NVIDIA’s fix adds that protection in version 1.9.0. Deployments running earlier versions that are reachable from untrusted networks carry the exposure described in the advisory until they update.
The update also touches three separate NVIDIA products, which shows the scope of the company’s AI software portfolio. TensorRT-LLM and PhysX are named alongside the agent toolkit in the same bulletin. The five secondary flaws run from 7.1 to 8.4, so even the lower-rated issues carry high severity scores. NVIDIA reported no exploitation, and the bulletin’s only maximum-severity entry is the missing-authentication flaw in the agent toolkit.
The fixed releases give operators concrete targets: NeMo Agent Toolkit 1.9.0 for the headline flaw and TensorRT-LLM 1.3.0rc25 for the inference library. The version string for TensorRT-LLM is a release candidate, which indicates the fix reached users through a pre-release build. NVIDIA did not report any customer attacks tied to the six flaws, and the identifiers listed in the bulletin give defenders what they need to match installed versions against the advisory.
