NemoClaw CVE-2026-65105: How a Browser Tab Can Poison Your Local Ollama AI Server

August 26, 2026 hadmin

A single visit to a malicious website should not be enough to compromise your infrastructure, but for developers running NVIDIA’s NemoClaw with a local Ollama model server, that’s exactly the attack surface exposed by CVE-2026-65105. Disclosed by Cyera’s research team alongside Oasis Security, the flaw lets an attacker bypass browser isolation and gain unauthenticated control of Ollama when it is bound to all network interfaces. From there, they can poison the model’s chat template, injecting persistent instructions that survive reinstalls of conversations and hide beneath operator guardrails. NVIDIA has shipped fixes for macOS and Linux in NemoClaw 0.0.35, but Windows and WSL users remain exposed. For hosting operators and self-hosters running inference engines on VPS or dedicated hardware, the lesson is broader: unauthenticated local services bound to 0.0.0.0 are a LAN and drive-by liability that undermines the privacy promise of on-device AI.

How NemoClaw Exposes Ollama to Drive-By Attacks

NemoClaw is built to run the OpenClaw AI agent inside NVIDIA’s OpenShell sandbox, which itself operates as a Docker container. For local inference, NemoClaw can use Ollama so that prompts and code never leave the developer’s machine. The connectivity problem is straightforward: a container cannot reach an Ollama service listening only on the loopback address 127.0.0.1. To bridge that gap, NemoClaw launches Ollama with the environment variable OLLAMA_HOST=0.0.0.0:11434, making the API listen on every interface.

For a more detailed walkthrough of this part of the topic, read KVM VPS vs Container VPS: Docker, CI/CD, AI Agents, and Self-Hosting Compared.

That decision solves container networking but disables a key Ollama protection. Ollama’s API requires no authentication and normally relies on CORS and Host-header checks to block unauthorized browser access. When bound to a non-loopback address, Host-header validation is skipped. The result is a locally running model server that any webpage can reach through a rebinding trick. Cyera’s researchers noted they could enumerate installed models, read system prompts, delete models, or even download large models to consume disk space—a cheap denial-of-service against a workstation or a small VPS.

The exposure is not limited to a single laptop. As independent analysis of the same CVE points out, because NemoClaw binds Ollama for container reachability, the API also becomes exposed to any device on the LAN without rebinding. Port 11434 turns into a shared, unauthenticated endpoint. Any host on the network can tamper with models if the firewall is silent.

DNS Rebinding: The Old Trick That Owns Local Model Servers

The mechanism that delivers the malicious request is not new. DNS rebinding has been a browser party trick for over a decade, as Randolph Barr, CISO at Cequence Security, observed. The novel part is aiming it at an unauthenticated local model server.

Here is how it works in this context. A victim visits a malicious webpage. That page’s domain initially resolves to the attacker’s server IP, satisfying same-origin policy checks. The attacker then changes the DNS response so the same hostname resolves to 127.0.0.1 or a local network address. The browser still treats subsequent requests as belonging to the attacker-controlled hostname, but the packets hit the local Ollama API. Because Ollama’s Host-header check is already disabled by the 0.0.0.0 binding, the CORS check passes and the request is executed with no credentials.

The attacker never connects directly to the victim’s Ollama from the internet. They ride the victim’s own browser session. For hosting buyers who install Ollama on a cloud instance and bind it to the public interface for convenience, the same class of risk applies: any compromised frontend or misdirected DNS can become a pivot into an unauthenticated model server.

Template Poisoning Persists Below the Guardrails

Gaining API access is only the first step. The more serious outcome is model template poisoning. A straightforward system-prompt injection fails because OpenClaw supplies its own system prompt when talking to the model. Cyera’s team instead targeted the model’s chat template—the layer that controls how messages are presented to the model.

By modifying the template, an attacker can preserve the model’s expected behavior while appending hidden instructions to system messages. Because the change lives at the model level, the OpenClaw agent does not see it and cannot override it with its own prompt. Elad Luz, head of research at Oasis Security, described the impact sharply: “With CVE-2026-65105, an attacker can alter how NemoClaw’s model reads every message it’s handed — one layer beneath anything a guardrail or an operator can see — and the change survives every future session, leaving an integrity problem that’s very hard to detect.”

The poisoned template persists across future conversations and remains invisible in ordinary model metadata. If the compromised agent has access to a filesystem, shell, source control, or cloud credentials—common in developer setups—the injected instructions could steer it toward attacker-controlled packages or URLs, suppress security warnings, introduce vulnerable code, or exfiltrate data through available network access. The poisoning remains until the model is re-pulled or NemoClaw is fully reinstalled.

Patching, Binding, and Hardening for Self-Hosted AI Workloads

NVIDIA has responded. According to the research summary, NemoClaw version 0.0.35 carries patches for macOS and Linux systems, while Windows and WSL remains unfixed at the time of disclosure. NVIDIA’s public statement confirmed an update is available for customers to download and install. If you run NemoClaw, prioritize that upgrade on supported platforms; on Windows, treat the integration as high-risk and restrict browser activity on the host.

For operators running Ollama independently—whether on a developer laptop, a VPS, or a dedicated server—the immediate checklist is to verify the bind address. Run sudo ss -tupln | grep ollama or sudo lsof -i :11434. You want to see 127.0.0.1; if you see 0.0.0.0, you are vulnerable. If container connectivity requires broader binding, use Docker’s internal network, an SSH tunnel, or a firewall rule that limits source IPs to the container host. Never leave port 11434 open to the LAN or public internet without authentication.

Audit model templates after any suspected exposure. Re-pull affected models and reinstall the agent framework to clear persistent changes. Hosting providers shipping AI blueprints should audit default configurations before praising “data never leaves the laptop”—the inference surface area is still network-exposed if bindings are lax.

Key Takeaways

Verify Ollama binding: Ensure it listens on 127.0.0.1, not 0.0.0.0, using ss or lsof.
Patch NemoClaw: Upgrade to 0.0.35 on macOS/Linux; Windows/WSL users must enforce network isolation.
Firewall port 11434: Block external access; allow only loopback or specific container bridges.
Rebuild poisoned models: Re-pull Ollama models and reinstall NemoClaw if exposure occurred.
Limit agent entitlements: Run local AI agents without broad filesystem or cloud-credential access unless absolutely required.

Conclusion

Local inference was supposed to be the safe alternative to shipping prompts to third-party clouds. CVE-2026-65105 is a reminder that “local” only means safe if the service is correctly bound, authenticated, and isolated. The combination of a Docker-driven 0.0.0.0 bind, missing Host-header checks, and DNS rebinding turned a privacy feature into a drive-by compromise channel. For HostXMe readers running AI workloads on VPS, dedicated servers, or workstations, the action is clear: patch where possible, bind to loopback, firewall the port, and treat model templates as part of your integrity baseline. Security for agentic systems is no longer about guarding tools—it is about securing identities with real entitlements.