A newly disclosed flaw in NVIDIA’s NemoClaw, the reference stack for running AI agents like OpenClaw inside NVIDIA’s OpenShell sandboxes, lets a single malicious webpage take over the local Ollama model server on a developer’s machine. Oasis Security published the research on August 25, 2026, tracking it as CVE-2026-65105. A fix for macOS and Linux shipped in NemoClaw v0.0.35. Windows and WSL are still unpatched.
How the NemoClaw Attack Works
NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434 so its sandboxed containers can reach the model server. That single setting is the whole problem: binding Ollama to every network interface instead of just localhost skips its Host header validation, according to Oasis Security’s writeup.
From there, a page the victim simply visits can run a DNS rebinding attack. The domain resolves to the attacker’s server first, then flips to 127.0.0.1, and the browser treats the follow-up requests as same origin. That’s enough to reach the victim’s Ollama instance directly from JavaScript running in the tab.
Once in, the attacker calls Ollama’s own API against itself. /api/show pulls a model’s existing chat template, the attacker edits the Go text/template that controls how every message gets rendered before inference, and /api/create re-uploads it. The poisoned template appends hidden instructions to every future system message. It survives the agent’s own prompt, it survives new conversations, and the user never sees it. Researchers Elad Luz and Ofek Itach note the same access exposes /api/pull and /api/delete, so an attacker can just as easily fill a victim’s disk with junk models or wipe the ones already installed.
Who Needs to Act
This affects anyone running NemoClaw with a local Ollama backend, which mainly means developers using it to keep coding-assistant prompts and source code off cloud APIs. If that’s your setup:
- Update to NemoClaw v0.0.35 if you’re on macOS or Linux.
- On Windows or WSL, there’s no fix yet. Don’t run NemoClaw’s Ollama backend on an untrusted network until one ships, and be deliberate about which sites you keep open in the same browser session.
- Check whether
NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBEis set in your environment. It disables the loopback-only proxy NVIDIA added in v0.0.106, which puts you back in the vulnerable configuration even on a patched install. - More generally, don’t bind any local model server to
0.0.0.0unless something outside your machine genuinely needs to reach it.
NVIDIA was notified through its PSIRT process ahead of publication, which is why a partial fix already exists.
This is also a good prompt to check any AI agent tooling a team has wired into its own workflow the same way, not just NemoClaw specifically. A local model server that trusts its network by default is an easy thing to miss during a fast AI integration build. It’s the kind of gap a security-focused look at an AI development setup catches before it ships, not after.
