CVE-2026-65081 is a high severity (CVSS 8.1) flaw in the installation process of NVIDIA NemoClaw for Linux, where an attacker could cause execution of untrusted code. NVIDIA's bulletin lists 0.0.21 as the updated version. Update from the NVIDIA repository and check what you installed.
What's affected
- Product: NVIDIA NemoClaw for Linux.
- Affected versions per NVIDIA's bulletin: 0 to 0.0.21.
- Updated version: 0.0.21, with fix commit
11af5fdac. - Description: the installation process, where an attacker could cause execution of untrusted code.
- Weakness: CWE-494. CVSS 8.1 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. - NVIDIA's instruction is to clone or update from the NVIDIA/NemoClaw GitHub repository.
How to check if you're exposed
NemoClaw is installed from the project repository, so find where you installed it and which release or commit it is on.
cd /path/to/NemoClaw
git describe --tags 2>/dev/null
git log -1 --format=%H
Compare it with the fix commit and the updated version in the bulletin. The bulletin lists several NemoClaw and OpenShell CVEs on the same date, so check against the full list.
What to do now
- Find every machine where NemoClaw was installed and note the release or commit.
- Update to 0.0.21 or newer from the official NVIDIA repository.
- Reinstall from a verified source if you ran the installer from an unverified mirror or copy.
- Pin installer sources and verify checksums where the project provides them.
- Run installers for new agent tooling in a disposable environment first.
Why it matters
The weakness is CWE-494, download of code without an integrity check. Installers are a classic spot for it: a script or package fetched at install time runs with the installing user's rights, so the integrity of what is fetched decides the outcome.
The vector shows high attack complexity, which narrows who can pull it off. The impact list in NVIDIA's text is wide: code execution, privilege escalation, tampering, disclosure and denial of service. The record's KEV flag is false, and the bulletin does not say attacks have occurred.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
NVIDIA lists 0.0.21 as the updated version.
Where should I get the update?
From the NVIDIA/NemoClaw GitHub repository, as the bulletin says.
Sources
Last reviewed: 19 October 2026.
