The report
NVIDIA's security bulletin 5912 identifies two separate NeMo Agent Toolkit vulnerabilities. CVE-2026-65145 concerns a missing-authentication boundary with potentially severe code and privilege effects; its published vector is network-based and its base score is 10.0. CVE-2026-65151 concerns SQL injection, but the disclosed vector is local, not automatically an unauthenticated internet endpoint.
| Advisory | Versions identified as affected | Corrected release |
|---|---|---|
| CVE-2026-65145: missing authentication | 1.0 through 1.8.0 | 1.9.0 |
| CVE-2026-65151: SQL injection | 1.4 through 1.6 | 1.7.0 |
The NVIDIA bulletin describes impact classes and version ranges without supplying a public end-to-end exploit transcript for every consequence. A severity score should therefore not be rewritten as evidence that exposed deployments were already exploited.
An operator auditing a serving environment should establish which component is reachable from the network, which principal reaches the SQL construction path, and which fixed release is actually deployed. The two canonical investigations preserve these separate questions: authentication exposure and local SQL injection. Updating to the relevant fixed version addresses the disclosed software condition; it does not on its own establish that historical access was benign.