A critical vulnerability in NVIDIA NemoClaw, tracked as CVE-2026-65105, could enable attackers to gain persistent control of locally deployed AI agents through a single visit to a malicious website.
Researchers Elad Luz and Ofek Itach from Oasis Security discovered that NemoClaw’s local Ollama configuration exposes an unauthenticated API, making it susceptible to DNS rebinding attacks.
An attacker could modify the AI model’s chat template, silently inserting instructions that persist across future interactions with the agent.
NVIDIA NemoClaw Vulnerability
NemoClaw deploys the OpenClaw AI agent within NVIDIA OpenShell sandboxes and can utilize Ollama as a local inference backend. This setup allows models to run on a developer’s own hardware rather than relying on a cloud-hosted API.
To enable communication between Docker-based OpenShell sandboxes and Ollama running on the host, NemoClaw configures the service with the following setting:
OLLAMA_HOST=0.0.0.0:11434This configuration binds Ollama to all network interfaces instead of just the loopback address (127.0.0.1). Although users are informed that Ollama is available on localhost:11434, the service can also be accessed from the local network, as reported by Cyera.
Ollama’s API on port 11434 does not require authentication. Instead, it relies on CORS controls and Host-header validation to restrict access from browser-originated requests. However, researchers discovered that Ollama bypasses Host-header validation when its bind address is set to a non-loopback address, such as 0.0.0.0.
The vulnerability can be exploited via DNS rebinding. This browser attack technique allows an attacker-controlled domain to resolve to different IP addresses over time.
In a typical attack scenario, a victim first visits a domain controlled by the attacker, which resolves to the attacker’s public server. The attacker then changes the domain’s DNS resolution to 127.0.0.1 or another local-network address. The browser continues to treat requests to the hostname as same-origin, redirecting those requests to the victim’s local Ollama service.
Because NemoClaw starts Ollama on 0.0.0.0, Host-header validation is bypassed. As a result, the browser’s Origin and Host values still match the attacker-controlled hostname, allowing the CORS check to succeed. This results in full, unauthenticated access to Ollama’s local HTTP API from JavaScript running in the victim’s browser.
The attacker could exploit accessible API endpoints to enumerate installed models, identify the Ollama version, extract model details, consume GPU resources through arbitrary inference requests, download large models to exhaust disk space, or delete existing models.
The most concerning outcome is model template poisoning. Ollama’s `/api/create` endpoint supports a template parameter that dictates how structured chat messages are converted into raw model input.
Unlike a model-level system prompt, which an AI agent can override with its own instructions, the template processes every message sent to the model during inference.
An attacker could obtain the legitimate template via `/api/show`, retain its formatting and rendering behavior, and inject hidden instructions into the system’s message-handling.
These attacker-controlled instructions would then be appended to the AI agent’s own system prompt during every subsequent interaction. This technique creates a persistent compromise that is challenging to detect, as the model can retain the same name, metadata, size, and apparent capabilities while executing malicious instructions in the background.
A compromised agent could be directed to generate backdoored code, suppress security warnings, recommend malicious packages or URLs, or exfiltrate conversation data and files if outbound access is permitted.
While OpenShell sandboxing can mitigate direct host-level risks through filesystem, network, and process isolation, the actual risk level depends on the permissions granted to the agent itself. AI agents often access source repositories, CI/CD systems, internal APIs, cloud platforms, messaging services, and Model Context Protocol servers.
The 0.0.0.0 binding also introduces a separate LAN exposure risk: other devices on the same network segment could directly access Ollama without needing DNS rebinding.
The researchers reported this issue to NVIDIA’s Product Security Incident Response Team before publication. Organizations using NemoClaw with local Ollama inference should review exposed interfaces, restrict access to port 11434, and audit model templates for unauthorized modifications.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
