NVIDIA NeMo Agent Toolkit MCP server missing authentication for critical function

#!/usr/bin/env bash
# check_cve_2026_65145.sh — Detect CVE-2026-65145 exposure
# Target: any host that may run NVIDIA NeMo Agent Toolkit
# Privileges: none (non-root)
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

VULN_FOUND=0
PATCHED=0
UNKNOWN=0

# Step 1: Check if nvidia-nat is installed and get version
if command -v pip &>/dev/null; then
  NAT_VERSION=$(pip show nvidia-nat 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
else
  NAT_VERSION=""
fi

if [ -z "$NAT_VERSION" ]; then
  # Also check pip3
  if command -v pip3 &>/dev/null; then
    NAT_VERSION=$(pip3 show nvidia-nat 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
  fi
fi

if [ -z "$NAT_VERSION" ]; then
  echo "[INFO] nvidia-nat package not found via pip/pip3."
  # Check if nat binary exists anyway
  if ! command -v nat &>/dev/null; then
    echo "[INFO] 'nat' CLI not found in PATH."
    echo "UNKNOWN — NeMo Agent Toolkit does not appear to be installed on this host."
    exit 2
  else
    echo "[WARN] 'nat' CLI found but pip package version unknown."
    UNKNOWN=1
  fi
fi

if [ -n "$NAT_VERSION" ]; then
  echo "[INFO] nvidia-nat version installed: $NAT_VERSION"
  # Compare version — vulnerable: 1.0 through 1.8.x; fixed: 1.9.0+
  MAJOR=$(echo "$NAT_VERSION" | cut -d. -f1)
  MINOR=$(echo "$NAT_VERSION" | cut -d. -f2)
  if [ "$MAJOR" -eq 1 ] && [ "$MINOR" -le 8 ]; then
    echo "[VULN] nvidia-nat $NAT_VERSION is in the affected range (1.0–1.8.x)."
    VULN_FOUND=1
  elif [ "$MAJOR" -eq 1 ] && [ "$MINOR" -ge 9 ]; then
    echo "[OK] nvidia-nat $NAT_VERSION is patched (>=1.9.0)."
    PATCHED=1
  elif [ "$MAJOR" -ge 2 ]; then
    echo "[OK] nvidia-nat $NAT_VERSION is beyond the affected range."
    PATCHED=1
  else
    echo "[WARN] Could not parse version: $NAT_VERSION"
    UNKNOWN=1
  fi
fi

# Step 2: Check for running NAT server processes bound to non-localhost
echo ""
echo "[INFO] Checking for running NeMo Agent Toolkit server processes..."
if command -v ss &>/dev/null; then
  EXPOSED=$(ss -tlnp 2>/dev/null | grep ':9902' | grep -v '127.0.0.1' | grep -v '\[::1\]' || true)
  LOCALHOST_BOUND=$(ss -tlnp 2>/dev/null | grep ':9902' | grep -E '127.0.0.1|\[::1\]' || true)
  if [ -n "$EXPOSED" ]; then
    echo "[CRITICAL] NAT server port 9902 is bound to a non-localhost address!"
    echo "  $EXPOSED"
    echo "  This instance is network-reachable and exploitable if unpatched."
    VULN_FOUND=1
  elif [ -n "$LOCALHOST_BOUND" ]; then
    echo "[INFO] NAT server port 9902 is bound to localhost only (not network-exposed)."
  else
    echo "[INFO] No process listening on port 9902."
  fi
elif command -v netstat &>/dev/null; then
  EXPOSED=$(netstat -tlnp 2>/dev/null | grep ':9902' | grep -v '127.0.0.1' | grep -v '::1' || true)
  if [ -n "$EXPOSED" ]; then
    echo "[CRITICAL] NAT server port 9902 is bound to a non-localhost address!"
    echo "  $EXPOSED"
    VULN_FOUND=1
  else
    echo "[INFO] No non-localhost listener on port 9902 detected."
  fi
else
  echo "[WARN] Neither ss nor netstat available — cannot check listening sockets."
fi

# Step 3: Verdict
echo ""
if [ "$VULN_FOUND" -eq 1 ]; then
  echo "VULNERABLE — CVE-2026-65145: nvidia-nat is in the affected range and/or exposed on a network interface."
  exit 1
elif [ "$PATCHED" -eq 1 ]; then
  echo "PATCHED — nvidia-nat version is >= 1.9.0."
  exit 0
else
  echo "UNKNOWN — could not definitively determine vulnerability status."
  exit 2
fi