CVE-2026-24231

Published: Apr 28, 2026Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 4.0

Source: psirt@nvidia.com (Secondary)

Description

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.

Affected (1)

Products: Nvidia: Nemoclaw

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nvidia Nemoclaw	Before 0.0.13

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-24231

Source: psirt@nvidia.com

US Government Resource

https://nvidia.custhelp.com/app/answers/detail/a_id/5837

Source: psirt@nvidia.com

Vendor Advisory

https://www.cve.org/CVERecord?id=CVE-2026-24231

Source: psirt@nvidia.com

Third Party Advisory

Timeline

No history available yet.