CVE-2026-65105: CWE-306 Missing Authentication for Critical Function in NVIDIA NemoClaw

CVE-2026-65105 is a vulnerability in NVIDIA NemoClaw for Linux where the inference server setup lacks proper authentication controls. This missing authentication (CWE-306) enables remote attackers to access the inference service without credentials. Exploitation may result in information disclosure and denial of service conditions. The vulnerability has a CVSS v3.1 base score of 8.1, with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

An attacker can remotely access the inference service without authentication, potentially leading to unauthorized disclosure of sensitive information and denial of service. The confidentiality and availability of the affected system are impacted, while integrity is not affected. This could disrupt normal operations of the inference server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the inference server to trusted users and networks to reduce exposure. Monitor for unusual access patterns. Follow NVIDIA's official guidance once published.