CVE-2026-47619 is a medium severity (CVSS 6.6) vulnerability in the examples and recipes shipped with NVIDIA Dynamo for Linux. An attacker could cause a system failure. NVIDIA's bulletin lists Dynamo up to v1.1.0 as affected and v1.2.0 as the updated version.
What's affected
- NVIDIA Dynamo for Linux: versions from the start up to v1.1.0 are affected. Updated version: v1.2.0.
This is the NVIDIA August 2026 Dynamo bulletin, which covers several CVEs. This CVE concerns the examples and recipes, not the core runtime, according to the description. NVIDIA's table scores it 6.6 (CVSS 3.1, Medium) with network vector, high attack complexity and high privileges required. It lists impacts of code execution, data tampering, denial of service and information disclosure.
The record names the Linux kernel as a second product, which looks like a platform tag.
How to check if you're exposed
Check which Dynamo version you installed and whether you copied anything from the examples and recipes folders into a deployment:
pip show ai-dynamo
The package name above is an assumption that you installed from PyPI, so confirm it against your own install method. If you cloned the repository, check the tag or commit you are on and compare it with v1.2.0. Example code is often copied into production with little review, so search your deployment configuration for files that came from the examples.
What to do now
- Update Dynamo to v1.2.0 or later.
- Inventory any example or recipe code you copied into a real environment and re-copy it from the updated release.
- Do not expose example services to untrusted networks.
- Read the NVIDIA bulletin for the other Dynamo CVEs published together, because the same update covers them.
Why it matters
The weakness class is CWE-1357, which describes reliance on insufficiently trustworthy components. NVIDIA's bulletin gives very little technical detail beyond that and a description of the impact, so this article does not guess at the mechanism.
What can be said safely is the practical point. Example and recipe code is written to teach, not to defend, and it tends to end up in real deployments. Treat it as code you own once you copy it. The record does not mark the issue as known exploited.
Quick check
Is the Dynamo core runtime affected?
The description places the flaw in the examples and recipes. Update anyway, because the fixed release also covers other CVEs in the same bulletin.
Why is there so little detail?
The vendor bulletin gives only a short description. Rely on the NVIDIA bulletin for updates rather than guesses about the mechanism.
Sources
Last reviewed: 18 October 2026.
