The problem starts with networking. Because the OpenShell sandbox runs inside a Docker container, it cannot reach an Ollama service listening only on the loopback address, 127.0.0.1. NemoClaw therefore starts Ollama with “OLLAMA_HOST=0.0.0.0:11434,” making it listen on all network interfaces.
That solves the container connectivity problem but also disables an important Ollama protection. Ollama’s API does not require authentication and normally uses CORS and Host-header checks to prevent unauthorized browser access. But when Ollama is bound to a non-loopback address, its Host-header validation is skipped.
An attacker can then use DNS rebinding to make a malicious webpage initially resolve to the attacker’s server and subsequently resolve to 127.0.0.1 or a local network address. The browser would still consider the requests to belong to the attacker-controlled hostname, but Ollama would receive them, resulting in unauthenticated access to the local API.
