NemoClaw CVE-2026-65105: How a Browser Tab Can Poison Your Local Ollama AI Server

A newly disclosed vulnerability tracked as CVE-2026-65105 exposes a dangerous blind spot for developers and hosting operators running Nvidia’s NemoClaw with local Ollama inference. According to research from Cyera and Oasis Security, a single visit to a malicious website can hijack the locally running Ollama model server by abusing DNS rebinding. The root cause is NemoClaw’s decision to bind Ollama to 0.0.0.0:11434 to satisfy Docker container networking, which disables critical host-header protections. The result is unauthenticated access and persistent poisoning of the model’s chat template—an integrity flaw that survives reinstalls of the agent and evades ordinary guardrails. Nvidia has patched non-Windows systems in NemoClaw 0.0.35, but Windows and WSL remain exposed.

How NemoClaw’s Network Binding Opens the Door

NemoClaw is built to run the OpenClaw AI agent inside Nvidia’s OpenShell sandbox, which operates as a Docker container. By design, the container cannot reach an Ollama service that listens only on the host loopback address 127.0.0.1. To bridge that gap, NemoClaw launches Ollama with the environment variable OLLAMA_HOST=0.0.0.0:11434, making the API listen on all network interfaces.

That choice solves container connectivity but quietly removes an important safety net. Ollama’s API has no built-in authentication and normally relies on CORS and Host-header checks to block unauthorized browser access from external sites. When Ollama is bound to a non-loopback address, its Host-header validation is skipped. An attacker can then use DNS rebinding: a malicious webpage initially resolves to the attacker’s server, then subsequently resolves to 127.0.0.1 or a local network address. The browser still treats the requests as belonging to the attacker’s hostname, yet Ollama receives them and grants unauthenticated API access.

As Randolph Barr, CISO at Cequence Security, noted, the individual pieces are not new—DNS rebinding has been a browser party trick for over a decade—but aiming it at an unauthenticated local model server is the novel and dangerous twist. Worse, because Ollama is bound to 0.0.0.0, any other device on the same LAN (or on the public internet if the host has no firewall) can reach port 11434 directly without even needing rebinding.

From Unauthenticated API Access to Persistent Model Poisoning

Once the browser reaches the local Ollama API, the attacker’s options expand quickly. Cyera’s research showed that an attacker could enumerate installed models and Ollama version, retrieve model details and system prompts, delete models, or download large models to consume disk space. Those are denial-of-service and reconnaissance effects, but the deeper problem is template poisoning.

A straightforward system-prompt injection was not enough because OpenClaw supplies its own system prompt when talking to the model. Instead, researchers modified the model’s chat template—the layer that controls how messages are presented to the model. By appending malicious instructions to system messages at the model level, the poison persists beneath the agent’s own prompt. OpenClaw cannot see or override it.

Elad Luz, head of research at Oasis Security, described the impact clearly: “With CVE-2026-65105, an attacker can alter how NemoClaw’s model reads every message it’s handed — one layer beneath anything a guardrail or an operator can see — and the change survives every future session, leaving an integrity problem that’s very hard to detect.” Injected instructions could steer the agent toward attacker-controlled packages or URLs, suppress security warnings, introduce vulnerable code, or exfiltrate information through available network access. If the agent holds filesystem, shell, or cloud credentials, the poison can leak API keys or silently modify source code. The modification remains invisible in ordinary model metadata and persists until the model is re-pulled or NemoClaw is fully reinstalled.

Who Is at Risk: Local Agents, LAN Servers, and Hosting Setups

The primary victims are developers running NemoClaw on macOS, Linux, or Windows/WSL machines for local AI agent work. However, the risk extends into hosting and infrastructure contexts. Any administrator running Ollama independently on a Linux VPS, dedicated server, or internal appliance—especially if paired with NemoClaw or similar agent frameworks—should audit their bind address. A server bound to 0.0.0.0:11434 inside a cloud tenant or office LAN is an unauthenticated endpoint for anyone who can trick a browser on that network.

Shipping NemoClaw blueprints to customers is also problematic: you may be shipping inference surface area while promising “data never leaves the laptop.” The demonstrated chain shows that template poisoning sits below harness guardrails such as CLAUDE.md or AGENTS.md, so conventional oversight may miss it. Nvidia has released version 0.0.35 carrying patches for macOS and Linux, but Windows and WSL remain unfixed at the time of writing. Other NemoClaw issues (e.g., CVE-2026-24222 for prompt-injection disclosure and CVE-2026-24231 for SSRF in endpoint validation) indicate a broader pattern of agent-security gaps. The tradeoff is clear: local inference avoids cloud latency and egress costs, but it shifts the security burden onto host networking and process isolation.

Mitigation and Hardening Steps for Server Operators

Patching and configuration discipline are the immediate priorities. On macOS and Linux, upgrade NemoClaw to 0.0.35 or later. Windows and WSL users must apply manual restrictions because no fix is available yet. Independent of the framework, verify what address Ollama is listening on:

sudo ss -tupln | grep ollama
# or
sudo lsof -i :11434

You want to see 127.0.0.1:11434. If you see 0.0.0.0:11434, the service is exposed. Set OLLAMA_HOST=127.0.0.1:11434 for self-managed deployments, and block port 11434 at the firewall so only localhost or a secured VPN tunnel can reach it. Disable general browser access on hosts that run experimental local agents, and audit model templates for unauthorized modifications. If poisoning is suspected, re-pull the affected model or fully reinstall NemoClaw to clear the corrupted chat template. Monitor disk usage for unexpected large model downloads, which can signal attacker activity.

Nvidia’s public statement acknowledged the researchers’ work and pointed to an available update: “Nvidia has issued an update that customers can download and install.” Treat that update as mandatory for any non-Windows inference host, and treat Windows hosts as high-risk until an official patch lands.

Practical Checklist / Key Takeaways

Patch NemoClaw to 0.0.35 on macOS and Linux; Windows/WSL remains unpatched—apply manual bind and firewall restrictions now.
Verify Ollama listener: sudo ss -tupln | grep ollama should show 127.0.0.1:11434, never 0.0.0.0.
Firewall port 11434: block inbound access from LAN and public networks; allow only loopback or a private tunnel.
Re-pull or reinstall models and NemoClaw if you previously ran a vulnerable setup, to evict persistent template poison.
Limit agent entitlements (filesystem, shell, cloud credentials) to shrink the blast radius of any compromised local model.

Conclusion

As AI agents gain real entitlements on developer machines and hosting nodes, they must be secured like first-class infrastructure—not like disposable tools. CVE-2026-65105 shows how a routine container networking convenience (0.0.0.0 binding) combined with browser DNS rebinding can turn a local Ollama server into a persistent poison target. For hosting buyers, sysadmins, and power users, the lesson is operational: audit your binds, patch promptly, isolate inference ports, and assume that any unpatched local agent may already be compromised. The web hosting world increasingly intersects with self-hosted AI; treating model servers with the same rigor as web or database services is no longer optional.

For a more detailed walkthrough of this part of the topic, read KVM VPS vs Container VPS: Docker, CI/CD, AI Agents, and Self-Hosting Compared.

Faceți căutări pe acest blog

Web Hosting