CVE-2026-65178

Executive Summary

CVE-2026-65178 is a deserialization-of-untrusted-data vulnerability (CWE-502) in NVIDIA NeMo's dataset-loading workflow, where a maliciously crafted model_config.yaml can inject unsafe parameters into the loading process. Successful exploitation may result in code execution, data tampering, denial of service, and information disclosure. The vulnerability carries a CVSS 3.1 base score of 7.8 (High) and is currently UNPATCHED with no vendor fix, workaround, public PoC, or exploit code available at the time of writing — leaving any organization operating NVIDIA NeMo in a default or unhardened configuration exposed to local, low-complexity attacks.

Technical Analysis

NVIDIA NeMo is an open-source toolkit for building, training, and fine-tuning large language models and generative AI systems. Its workflows rely on declarative configuration files — most notably model_config.yaml — that describe dataset sources, preprocessing steps, and model parameters. CVE-2026-65178 arises from that configuration-driven loading path: a crafted model_config.yaml can cause unsafe parameters to be injected into the dataset-loading process.

The root cause is classified as CWE-502: Deserialization of Untrusted Data. In this class of flaw, the application reconstructs an object or invokes a loader from input that an attacker controls, without adequately validating that input. When the deserialization path permits attacker-influenced values to reach object construction or code-loading primitives, the attacker can redirect execution, tamper with data, or crash the process.

Two properties of this vulnerability define its attack surface:

1. Configuration file as attack vector. The vulnerable input is a YAML configuration file consumed during model/dataset initialization. This is a file that operators frequently copy, share, and load from model repositories, shared storage, or downloaded checkpoints. Its contents are often trusted implicitly because YAML appears declarative rather than executable — a dangerous assumption in any deserialization context.
2. Local attack vector with low privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates the attacker must already have a foothold on, or write access to, the host/filesystem where the configuration is loaded. No user interaction is required (UI:N), and the attack is not complex (AC:L). This puts the flaw squarely in the post-compromise privilege escalation and trusted-artifact poisoning categories rather than the remote network-exposure category.

The specific loader functions, parameter names, or injected keys inside model_config.yaml are not disclosed in the NVD description or CNA title, and no public advisory enumerates them. The report therefore stays at the vulnerability-class level: an externally supplied YAML configuration is parsed and its values reach a deserialization/code-loading path that does not sufficiently restrict unsafe content. The impact confirmed by NVD — code execution, data tampering, denial of service, and information disclosure — is fully consistent with an unsafe deserialization primitive, which typically yields at minimum the ability to invoke attacker-controlled objects or commands in the process context.

Exploitation Scenarios

Important caveat: No public PoC or exploit code exists, and the CNA/NVD description does not disclose the exact YAML keys or loader functions. The chain below is inferred strictly from the vulnerability class (CWE-502 unsafe deserialization via a configuration file) and the CVSS vector. Attack chain is inferred from vulnerability class. No specific function names, endpoints, or parameter names are asserted because none are available in the source data.

1. Reconnaissance / target identification. The attacker identifies a host or CI/CD environment running NVIDIA NeMo where model and dataset configurations are loaded from a filesystem location the attacker can influence. This may be a shared network share, a mounted model repository, a container build context, a CI artifact store, or a notebook environment. Because the vector is Local (AV:L) with Low privileges (PR:L), the attacker's starting position is typically an account with write access to a configuration directory or the ability to commit/substitute a model_config.yaml consumed downstream.

2. Triggering the flaw class. The attacker replaces or introduces a model_config.yaml containing unsafe parameters. When NVIDIA NeMo's dataset-loading workflow parses that file and passes the injected values into the deserialization path, the unsafe content is acted upon. No user interaction is needed — the trigger occurs whenever the workload loads the poisoned configuration (training start, dataset ingestion, model initialization). This is the essence of the "maliciously crafted model_config.yaml → unsafe parameter injection" described by NVD.

3. Payload / execution method (class level). At the vulnerability-class level, an attacker crafts the configuration so that the loader resolves an attacker-controlled object or code path instead of the intended dataset source. Because the impact set includes code execution, the payload achieves arbitrary code execution in the context of the NeMo process (which on GPU/training hosts is frequently privileged or holds sensitive data-mount credentials). Because it also includes data tampering and information disclosure, the payload may alternatively or additionally redirect dataset reads to attacker-controlled or modified data and exfiltrate model/dataset artifacts. No specific serializer payload or gadget chain is asserted here — none is disclosed.

4. Post-exploitation impact. Given C:H / I:H / A:H, the attacker can potentially: execute arbitrary code under the NeMo service account; exfiltrate training data, model weights, and embedded credentials (information disclosure); corrupt training datasets or model checkpoints (data tampering); and kill or wedge workloads (denial of service). In multi-tenant ML platforms, code execution inside the training container can also serve as a pivot into the underlying orchestrator or shared storage.

Impact Assessment

• Confidentiality (C:H): High. Training datasets, proprietary model weights, configuration secrets, and cloud/registry credentials accessible to the NeMo process may be disclosed.
• Integrity (I:H): High. Dataset and checkpoint tampering can silently poison downstream models — a supply-chain-grade impact where corrupted artifacts propagate to deployed AI systems.
• Availability (A:H): High. Denial of service can halt expensive, long-running training jobs, causing significant scheduling and cost disruption.
• Scope (S:U): Unchanged. Impact is confined to the vulnerable component and its host process context per the CVSS assessment.
• Attack requirements: Local access with Low privileges, Low complexity, no user interaction. This combination makes the flaw attractive for lateral movement and privilege escalation once any foothold or write access to configuration storage exists.

Blast radius: Any single-tenant or multi-tenant deployment of NVIDIA NeMo that loads model_config.yaml (or equivalent dataset/model configuration) from a location writable by a lower-privileged principal. In shared ML platforms, one compromised or malicious tenant could affect other workloads sharing the same configuration/model store. Because the vulnerability is UNPATCHED with no workaround listed, all currently deployed instances in an unhardened configuration should be treated as exposed on the local attack surface.

Detection Guidance

Detection is challenging because the attack abuses a legitimate configuration file and a legitimate loading workflow. Defenses should focus on integrity monitoring of model_config.yaml, process behavior from the NeMo service account, and network egress from training environments. The following rules are written to catch suspicious modification or anomalous interpretation of configuration inputs consistent with the vulnerability class; they are not signature matches for a disclosed exploit (none exists).

Sigma Rule

title: Suspicious model_config.yaml Modification in NVIDIA NeMo Dataset Workflow
id: 7b1c9e42-3a5d-4f10-9c2e-nemo65178
status: experimental
description: Detects creation or modification of model_config.yaml files by non-service accounts, consistent with tampering of NVIDIA NeMo dataset-loading configuration (CVE-2026-65178, CWE-502).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65178
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  category: file_event
detection:
  selection_filename:
    TargetFilename|endswith:
      - 'model_config.yaml'
      - 'model_config.yml'
  selection_action:
    EventType:
      - 'Create'
      - 'Write'
      - 'Modify'
  filter_service_account:
    User|contains:
      - 'nemo'
      - 'root'
  condition: selection_filename and selection_action and not filter_service_account
falsepositives:
  - Legitimate model configuration updates by authorized ML engineers outside the service account
level: medium
tags:
  - attack.t1059
  - attack.persistence
  - cve.2026.65178

YARA Rule

rule CVE_2026_65178_NeMo_Malicious_ModelConfig
{
    meta:
        description = "Detects model_config.yaml files containing suspicious parameter-injection / deserialization indicators targeting NVIDIA NeMo dataset-loading (CVE-2026-65178, CWE-502)."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65178"
        date = "2026-01-01"
        severity = "high"

    strings:
        $yaml_key = "model_config" nocase
        $ds = "dataset" nocase
        $mk = "!!python/object" ascii wide
        $mk2 = "!!python/object/apply" ascii wide
        $mk3 = "!!python/name" ascii wide
        $pickle = "\\x80\\x04\\x95" ascii
        $exec = "os.system" ascii wide
        $sub = "subprocess" ascii wide
        $eval = "__reduce__" ascii wide

    condition:
        (uint32(0) == 0x0A2D2D2D or true) and
        (
            ($mk or $mk2 or $mk3 or $pickle)
            and ($exec or $sub or $eval)
        ) or
        (
            $yaml_key and $ds and ($pickle or $mk2)
        )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-65178 NVIDIA NeMo Possible Post-Exploitation Exfiltration (dataset/model_config context)"; flow:to_server,established; content:"model_config"; nocase; content:".yaml"; nocase; distance:0; within:64; pcre:"/(?i)(dataset|checkpoint|weights)/"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; sid:202665178; rev:1; reference:cve,2026-65178; metadata:service http,service ssl;)

Note: Because this is a local (AV:L) configuration-poisoning flaw, network detection is limited. The rule above targets the observable egress that a successful post-exploitation chain (data exfiltration of datasets or model weights) would generate and is provided as a compensating control, not a direct exploit signature.

Elastic Detection

file where event.action in ("creation", "modification", "rename")
  and file.name : "model_config.y*ml"
  and not user.name : ("nemo", "root")
  and not process.name : ("git", "vi", "vim", "nano")

Detects out-of-band modification of NeMo configuration files on monitored endpoints, surfacing potential pre-trigger tampering consistent with CVE-2026-65178.

Splunk SPL Query

index=endpoint OR index=ml_platform
(EventType=Create OR EventType=Modify OR action=file_modify)
TargetFilename=*model_config.y*
NOT User IN ("nemo","root","svc_nemo")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(ProcessName) as processes values(User) as users
        by ComputerName, TargetFilename
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="nvidia_nemo,cve-2026-65178,">
  <rule id="100651" level="10">
    <if_sid>550</if_sid>
    <field name="file">model_config\.ya?ml$</field>
    <description>CVE-2026-65178: NVIDIA NeMo model_config.yaml modified - possible unsafe parameter injection (CWE-502).</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>config_tampering,</group>
  </rule>

  <rule id="100652" level="12">
    <if_sid>100651</if_sid>
    <field name="user">^(?!nemo$|root$).*</field>
    <description>CVE-2026-65178: NVIDIA NeMo model_config.yaml modified by non-service account - high risk configuration injection.</description>
    <group>config_tampering,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; the vendor fix and workarounds are listed as N/A. The following guidance is therefore mitigation-only and should be treated as compensating controls until NVIDIA publishes a fix.

1) Immediate mitigations

• Lock down configuration files. Enforce restrictive filesystem permissions on every model_config.yaml and equivalent NeMo configuration so that only the dedicated NeMo service account (and root) may create or modify them. Remove write access for general users, notebooks, and shared shares.
• Treat configurations as untrusted input. Restrict where configurations can be loaded from (block loading from world-writable network shares, untrusted repositories, or user home directories). Validate/scan model_config.yaml before loading.
• Apply least privilege to the NeMo process. Run NeMo workloads as an unprivileged, containerized service account with no unnecessary mounts, no host credential exposure, and restricted egress. This bounds the impact of code execution and data tampering.
• Integrity monitoring. Deploy the detection rules above (Sigma/YARA/Wazuh) to alert on out-of-band modification of NeMo configuration files.
• Isolate tenants. In multi-tenant ML platforms, segregate configuration and model storage per tenant to prevent cross-tenant poisoning.

2) Patch / upgrade steps

• Monitor the NVIDIA NeMo security advisories and the NVD entry for CVE-2026-65178 for an official fix. As of this report, no patched version is available; AFFECTED_VERSION is unpublished.
• Once a fix is released, upgrade NeMo to the vendor-designated fixed version and re-audit all stored model_config.yaml files for unauthorized parameters. Because no version range is documented, operators should assume all deployed versions are affected.
• Re-scan model/dataset repositories for tampered configurations before resuming training.

3) Long-term hardening

• Adopt safe configuration parsing: use deserialization modes that do not permit object construction/code loading from YAML, and reject unknown or unsafe parameters at schema-validation time.
• Implement signed configuration/model artifacts so that only cryptographically verified model_config.yaml files are loaded — directly mitigating trust-in-artifact poisoning.
• Establish provenance and review controls for any configuration pulled from external or shared sources.
• Continuously monitor vendor advisory feeds (NVIDIA, NVD, CISA KEV) and watch for this CVE migrating to KEV or gaining a public PoC; public exploitation would materially raise the priority for emergency mitigation.

References

1. NVD — CVE-2026-65178: https://nvd.nist.gov/vuln/detail/CVE-2026-65178
2. MITRE CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html
3. NVIDIA Product Security / NeMo advisories portal: https://www.nvidia.com/en-us/security/
4. NVIDIA NeMo documentation (dataset and configuration workflow): https://docs.nvidia.com/nemo/
5. CISA Known Exploited Vulnerabilities catalog (monitor for potential addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: None. EPSS has not yet scored this CVE, CISA KEV does not list it, and no public PoC, exploit code, or threat actor campaign is currently attributed to CVE-2026-65178. All exploitation details in this report are inferred from the vulnerability class and CVSS assessment.