Oasis Security researchers Elad Luz and Ofek Itach have disclosed CVE-2026-65105, a flaw in NVIDIA NemoClaw — an OpenClaw-based AI agent wrapper that runs local inference through Ollama inside NVIDIA’s OpenShell sandbox. A single visit to an attacker-controlled webpage is enough to give a remote attacker full, unauthenticated control over the Ollama instance backing the agent, including the ability to permanently rewrite the model’s system prompt via template poisoning.
What Happened
NemoClaw deploys its agent sandbox as a Docker container that needs to reach a local Ollama inference server. To make that possible, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434 — binding the API to every network interface on the host, not just the container bridge. That single configuration choice also disables Ollama’s built-in Host-header validation, so the API ends up reachable, unauthenticated, from anywhere on the local network — and, via DNS rebinding, from the public internet.
The attack requires no phishing beyond a page visit: an attacker registers a domain whose DNS answer alternates between their own server and 127.0.0.1/localhost. A victim loads the page while NemoClaw is running; the browser’s same-origin policy is satisfied because the Origin and Host headers both resolve to the attacker-controlled domain at request time, so Ollama’s CORS middleware treats the rebound request as same-origin. Once the rebinding succeeds, the malicious JavaScript has direct, authenticated-as-local access to the Ollama REST API on port 11434.
Technical Details
With API access established, the attacker fetches the target model’s existing chat template via /api/show, which returns the Go text/template that controls how conversation history and system messages are rendered before being handed to the inference engine. The attacker injects hidden instructions into that template and re-uploads the poisoned version through /api/create, overwriting the original model definition.
Because the template sits between the client’s messages and the model itself, the injected instructions are appended to every future system-message render — invisibly, from the perspective of anything calling the API. The agent (and any developer tooling built on top of it) keeps functioning normally; every subsequent conversation just silently carries attacker-controlled instructions baked into the prompt. The poisoning survives process restarts and new sessions since it’s persisted in the model definition, not in application state. The same unauthenticated API surface also lets an attacker enumerate installed models, pull arbitrary new ones, or delete existing ones outright.
As Oasis Security put it: sandboxing protects the container’s filesystem and process boundary, but it does nothing once the attacker has taken over the model backing the agent — at that point they inherit whatever tools and access the agent itself has been granted.
Impact
This affects any developer or organization running NemoClaw locally with Ollama exposed via the default configuration — a deployment pattern NVIDIA’s own documentation encourages for local agentic development. Because the poisoned template persists at the model level rather than in a single session, cleanup requires recognizing the compromise happened at all; a developer who merely restarts the agent or clears chat history will still be running a backdoored model. Any downstream action the agent is permitted to take — file edits, shell commands, API calls, code execution — inherits the attacker’s injected instructions with no signal to the user that anything has changed.
Mitigation
NVIDIA and the NemoClaw maintainers shipped a fix in v0.0.35 that addresses the exposure on macOS and Linux; Windows and WSL builds remain unpatched as of this writing, so treat any Windows/WSL NemoClaw install as vulnerable regardless of version. Update to 0.0.35 or later on supported platforms immediately.
Independent of the patch, do not run Ollama bound to 0.0.0.0 on a host that also does anything else on the network — bind it to 127.0.0.1 or a container-only bridge address and let only the sandbox container reach it, rather than exposing it host-wide. Firewall port 11434 from the local network and the internet. If you’ve run NemoClaw prior to patching, treat any locally hosted model as potentially poisoned: pull /api/show on each model to inspect its current template for injected content, and when in doubt, delete and re-pull affected models from a known-good source rather than trusting an in-place check.