CVE-2026-65084 is a high severity (CVSS 8.1) flaw in the deployment process of NVIDIA NemoClaw for Linux, an improper certificate validation. NVIDIA's bulletin lists 0.0.1 as the updated version, which is the oldest fix among the NemoClaw entries. Update to the newest release from the NVIDIA repository.
What's affected
- Product: NVIDIA NemoClaw for Linux.
- Affected versions per NVIDIA's bulletin: 0 to 0.0.1.
- Updated version: 0.0.1, with fix commit
b7c254114. - Description: the deployment process, where an attacker could cause improper certificate validation.
- Weakness: CWE-295. CVSS 8.1 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. - NVIDIA's instruction is to clone or update from the NVIDIA/NemoClaw GitHub repository.
How to check if you're exposed
NemoClaw is installed from the project repository, so find where you installed it and which release or commit it is on.
cd /path/to/NemoClaw
git describe --tags 2>/dev/null
git log -1 --format=%H
The listed updated version is 0.0.1. The bulletin lists several NemoClaw and OpenShell CVEs on the same date, so check against the full list.
What to do now
- Find every NemoClaw install and note its release or commit.
- Update to the newest release from the official NVIDIA repository. The bulletin's other entries list later versions.
- Check which networks and proxies your deployments pass through, and avoid interception on them.
- Redeploy anything that was set up over an untrusted network before updating.
Why it matters
The weakness is CWE-295. During deployment the tool talks to remote systems, and if it does not check certificates properly, a party in the path can pose as the real endpoint. The vector shows high complexity, so the attacker needs a position that is not easy to get.
NVIDIA lists code execution, privilege escalation, tampering and disclosure as possible results. The record's KEV flag is false.
Quick check
Is 0.0.1 really the fix?
The bulletin lists 0.0.1 as the updated version for this entry. Use the newest release from the repository, which includes the other fixes.
Why does certificate validation matter at deploy time?
Because a deployment pulls and pushes trusted material, and an impostor endpoint can substitute its own.
Sources
Last reviewed: 19 October 2026.
