CVE-2026-47613: CWE-918 Server-Side Request Forgery (SSRF) in NVIDIA Dynamo
NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by supplying a crafted local path in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.
AI Analysis
Technical Summary
CVE-2026-47613 describes a server-side request forgery vulnerability in NVIDIA Dynamo for Linux. The issue arises from improper limitation of a pathname to a restricted directory when processing a crafted local path in a multimodal request. This flaw could allow an attacker to access information that should be restricted. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No remediation level or patch information is currently available from the vendor.
Potential Impact
Successful exploitation of this vulnerability may lead to unauthorized information disclosure. There is no indication of impact on integrity or availability. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor NVIDIA's advisories for updates and apply patches once available.
CVE-2026-47613: CWE-918 Server-Side Request Forgery (SSRF) in NVIDIA Dynamo
Description
NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by supplying a crafted local path in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47613 describes a server-side request forgery vulnerability in NVIDIA Dynamo for Linux. The issue arises from improper limitation of a pathname to a restricted directory when processing a crafted local path in a multimodal request. This flaw could allow an attacker to access information that should be restricted. The vulnerability is rated high severity with a CVSS 3.1 score of 7.5, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No remediation level or patch information is currently available from the vendor.
Potential Impact
Successful exploitation of this vulnerability may lead to unauthorized information disclosure. There is no indication of impact on integrity or availability. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor NVIDIA's advisories for updates and apply patches once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- nvidia
- Date Reserved
- 2026-05-19T19:55:51.494Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7227ffbf8831d53935a8f5
Added to database: 08/04/2026, 17:57:19 UTC
Last enriched: 08/04/2026, 18:14:45 UTC
Last updated: 08/05/2026, 00:40:46 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.