CVE-2026-65098 is a high severity (CVSS 8.1) weak authentication flaw in the remote access helper workflow of NVIDIA NemoClaw for Linux. NVIDIA's bulletin lists 0.0.4 as the updated version. Update from the NVIDIA repository and keep the helper off networks you do not control.
What's affected
- Product: NVIDIA NemoClaw for Linux.
- Affected versions per NVIDIA's bulletin: 0 to 0.0.4.
- Updated version: 0.0.4, with fix commit
5864d9751. - Description: the remote access helper workflow, where an attacker could cause weak authentication.
- Weakness: CWE-1390. CVSS 8.1 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. - NVIDIA's instruction is to clone or update from the NVIDIA/NemoClaw GitHub repository.
How to check if you're exposed
NemoClaw is installed from the project repository, so find where you installed it and which release or commit it is on.
cd /path/to/NemoClaw
git describe --tags 2>/dev/null
git log -1 --format=%H
Compare it with the fix commit and the updated version in the bulletin. The bulletin lists several NemoClaw and OpenShell CVEs on the same date, so check against the full list.
What to do now
- Find every NemoClaw install and note whether the remote access helper is in use.
- Update to 0.0.4 or newer, ideally the newest release from the official NVIDIA repository.
- Limit who can reach the helper with network rules.
- Rotate any credentials or keys the helper used.
Why it matters
The weakness is CWE-1390, weak authentication. A helper that offers remote access has to prove who is asking. When that proof is weak, the helper's reach becomes available to someone else.
NVIDIA lists code execution, disclosure and tampering as possible results. The record's KEV flag is false, and the bulletin does not report attacks.
Quick check
Which version fixes it?
NVIDIA lists 0.0.4.
What should I do about the helper itself?
Do not expose it to networks you do not control, and turn it off if you do not use it.
Sources
Last reviewed: 19 October 2026.
