NemoClaw CVE-2026-65105: How a Browser Tab Can Poison Your Local Ollama AI Server
A newly disclosed vulnerability tracked as CVE-2026-65105 exposes a dangerous blind spot for developers and hosting operators running Nvidia’s NemoClaw with local Ollama inference. According to research from Cyera and Oasis Security, a single visit to a malicious website can hijack the locally running Ollama model server by abusing DNS rebinding. The root cause is NemoClaw’s decision to bind Ollama to 0.0.0.0:11434 to satisfy Docker container networking, which disables critical host-header protections. The result is unauthenticated access and persistent poisoning of the model’s chat template—an integrity flaw that survives reinstalls of the agent and evades ordinary guardrails. Nvidia has patched non-Windows systems in NemoClaw 0.0.35, but Windows and WSL remain exposed. Related ServerSpan guide: CVE-2025-62725: How a 'Read-Only' Docker Compose Command Can Compromise Your Host . How NemoClaw’s Network Binding Opens the Door NemoClaw is built to run the OpenClaw AI agent i...