{"id":"CVE-2026-65151","kind":"vulnerability","aliases":["CVE-2026-65151"],"related":[],"title":"NVIDIA NeMo Agent Toolkit: SQL injection enables data tampering and disclosure","description":"NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.","summary":"NVIDIA NeMo Agent Toolkit has a SQL injection flaw, where crafted input reaches a database query unescaped. An attacker could tamper with stored data, cause denial of service, or read information from the database.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","nvidia-nemo-agent-toolkit"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-27T13:16:59+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","triaged_at":"2026-10-27T13:32:15+00:00","updated_at":"2026-10-27T13:32:15+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-27T13:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"NVIDIA NeMo Agent Toolkit: SQL injection enables data tampering and disclosure","impact":"high","summary":"NVIDIA NeMo Agent Toolkit has a SQL injection flaw, where crafted input reaches a database query unescaped. An attacker could tamper with stored data, cause denial of service, or read information from the database.","category":"ai-tooling","nicknames":[],"who_cares":["nvidia-nemo-agent-toolkit","ai-agents"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker tampers with database data and reads sensitive information","analyst_note":"Check the NVIDIA security bulletin and NVD entry for affected versions, the vulnerable component, and whether the injection is reachable without auth.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000516,"input_tokens":3295,"output_tokens":373,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65151':14A,17A 'agent':3A,20B,27B,31B,65C 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'attack':47B,71C 'caus':53B,73C 'contain':67C 'could':48B,72C 'craft':39B 'cve':12A,15A 'data':8A,52B,87C 'databas':43B,62B 'denial':54B,89C 'disclosur':11A,94C 'enabl':7A 'exploit':80C 'flaw':37B 'inform':59B,93C 'inject':6A,36B,76C 'input':40B 'issu':77C 'lead':85C 'might':84C 'nemo':2A,26B,30B,64C 'nvidia':1A,25B,29B,63C 'nvidia-nemo-agent-toolkit':24B 'queri':44B 'reach':41B 'read':58B 'servic':56B,91C 'sql':5A,35B,75C 'store':51B 'success':79C 'tamper':9A,49B,88C 'tool':23B 'toolkit':4A,28B,32B,66C 'unescap':45B 'vulner':68C,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65151","severity":null,"published_at":"2026-10-27T13:16:59+00:00","modified_at":"2026-10-27T13:16:59+00:00","first_seen_at":"2026-10-27T13:31:51+00:00","fetched_at":"2026-10-27T13:31:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}