Security Vulnerability Lets Malicious Webpages Poison Local AI Models Behind NVIDIA NemoClaw

Critical Flaw Exposes Local AI Infrastructure

Oasis Security has disclosed CVE-2026-65105, a security vulnerability in NVIDIA NemoClaw that allows attackers to gain unauthenticated control of local Ollama instances and poison local AI models through a malicious webpage1

1

2

2

. The vulnerability was reported to NVIDIA's Product Security Incident Response Team before publication, marking the first research from Oasis Security since Cyera agreed to acquire the company for a reported $1 billion in July2

2

. As of August 25, 2026, no exploitation has been reported, though the disclosure carries no affected version range or patched version information1

1

.

How the Attack Chain Works

NVIDIA NemoClaw is an open source reference stack for running AI agents like OpenClaw inside OpenShell sandboxes, with Ollama as a supported local inference backend1

1

. The vulnerability stems from NemoClaw launching Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the model server to every network interface rather than localhost2

2

. This configuration bypasses authentication mechanisms that typically protect the Ollama AI model's API on port 114341

1

. Attackers exploit DNS rebinding attacks to circumvent browser security. The malicious domain initially resolves to the attacker's server serving a webpage on port 11434, then re-resolves to 127.0.0.1 while the browser continues treating requests as same-origin1

1

. When the bind address is not loopback, Host/Origin header validation checks are skipped entirely, allowing browser-originated requests to reach the API1

1

.

Model Poisoning Through Template Manipulation

Once API access is established, attackers can inject hidden instructions that persist across conversations by manipulating the chat template—a model-level property invisible to API consumers1

1

. Using Ollama's /api/create endpoint, attackers modify the Go template that renders message arrays into raw text before model processing1

1

. This poisoned template appends attacker-controlled text to every system prompt at inference time, surviving even when the AI agent infrastructure supplies its own system prompts1

1

. Elad Luz, head of research at Oasis Security, explained the change sits "one layer beneath anything a guardrail or an operator can see," creating an integrity problem that is extremely difficult to detect2

2

. Instructions planted this way can direct agents to write code vulnerability insertion, suppress security warnings, or enable data exfiltration to external endpoints2

2

.

Sandboxing Protections Prove Insufficient

The vulnerability highlights fundamental limitations in current AI agent infrastructure security approaches. While sandboxing protections like OpenShell fence off file systems, networks, and processes, they fail to protect against attacks targeting the model server itself1

1

. "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools," Oasis Security stated1

1

. Randolph Barr, CISO at Cequence Security, noted that "sandboxing the agent doesn't buy you much if the thing it's built on top of is reachable from any tab in the browser"2

2

. The blast radius of AI systems lies in their authorizations rather than their isolation, making the underlying infrastructure a critical attack surface2

2

.

Platform-Specific Configurations and Mitigation

NemoClaw's Ollama handling varies significantly across platforms, with Windows-host configurations particularly vulnerable. Non-WSL hosts keep Ollama on loopback behind a token-gated reverse proxy, while Docker Desktop on WSL skips the proxy because containers reach the host's loopback through host.docker.internal1

1

. The Windows-host path sets OLLAMA_HOST=0.0.0.0:11434 so Docker Desktop containers can reach the daemon without authentication1

1

. NemoClaw v0.0.106, released August 10, introduced a default where the local Ollama proxy refuses to start against backends not bound to loopback1

1

. However, this check doesn't run on WSL paths where the Windows-host configuration applies, and operators can override it with NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=11

1

.

Historical Context and Future Implications

DNS rebinding attacks against Ollama's API are documented, with Ollama shipping a fix in v0.1.29 on March 14, 2024, later published as CVE-2024-28224 by NCC Group1

1

. Collin Hogue-Spears from Black Duck Software noted that while Ollama hardened browser-to-local-service exposure in 2024, NemoClaw's design choices reintroduced the vulnerability2

2

. Security experts emphasize that the individual attack components aren't new, but targeting unauthenticated local model servers represents an emerging threat vector as agentic AI deployment accelerates. Organizations should verify Host and Origin headers on the server side, maintain Ollama on loopback behind authenticated proxies, and implement chat template integrity checks to detect unauthorized modifications.