A newly uncovered critical vulnerability within NVIDIA’s NemoClaw, designated as CVE-2026-65105, presents significant risks by enabling attackers to gain persistent control over locally deployed AI agents through merely visiting a compromised website. This alarming finding has garnered attention in cybersecurity circles, highlighting the potential dangers lurking in seemingly innocuous technologies.
The vulnerability was brought to light by cybersecurity researchers Elad Luz and Ofek Itach from Oasis Security. Their investigation revealed that the local Ollama configuration used by NemoClaw exposes an unauthenticated API, rendering it vulnerable to a specific type of attack known as DNS rebinding. This vulnerability could potentially put numerous users at risk, as it allows attackers to exploit the system without the need for prior authentication or permissions.
In technical terms, the implications of this vulnerability are profound. An attacker could subtly alter the AI model’s chat template, inserting instructions that become enduring features of the agent’s functionality. This modification would go undetected during normal operations, as subsequent interactions with the AI still appear to be legitimate.
Understanding the Architecture of NVIDIA NemoClaw
To comprehend the ramifications of the NemoClaw vulnerability, it is essential to examine its underlying architecture. NemoClaw deploys the OpenClaw AI agent within NVIDIA OpenShell sandboxes, utilizing Ollama as a local inference backend. This design allows developers to run their AI models on personal hardware, avoiding reliance on cloud-hosted APIs, thus enhancing privacy and control.
However, the setup includes a critical configuration: the service is set with the following command:
OLLAMA_HOST=0.0.0.0:11434This line of code binds Ollama to all network interfaces rather than limiting it to the local loopback address (127.0.0.1). Although users are led to believe they can only access Ollama through localhost at port 11434, the reality is that it can also be accessed from any device connected to the local network. This aspect has been corroborated by findings from Cyera, indicating that the security implications are more significant than first assumed.
A Flawed Access Control Mechanism
The Ollama API at port 11434 does not implement adequate authentication measures. Instead, it relies on Cross-Origin Resource Sharing (CORS) controls and Host-header validation to restrict access solely to requests originating from browsers. However, researchers found that when Ollama’s bind address is set to a non-loopback state, such as 0.0.0.0, the Host-header validation can be bypassed.
This creates a substantial threat vector, allowing attackers to utilize DNS rebinding techniques. In a typical attack scenario, a victim may be lured to a website controlled by the attacker. This site would resolve to the attacker’s server initially but can later be manipulated to resolve to the victim’s localhost (127.0.0.1). Because the browser perceives this connection as originating from the same domain, it fails to identify the malicious intent.
Consequences of Exploitation
The consequences of this vulnerability extend beyond minor annoyances; they represent serious threats to the integrity of AI operations. Attackers would have unfettered access to a variety of API endpoints, enabling them to enumerate installed models, identify the Ollama version, and even launch arbitrary inference requests. In extreme scenarios, they could completely exhaust local disk space or even delete critical models stored in the system.
The most concerning aspect is the potential for model template poisoning. The API’s /api/create endpoint allows an attacker to influence how structured chat messages are formatted and processed. Unlike a model-level system prompt, which the AI can often bypass or ignore, the template parameter affects every interaction with the model. Thus, an attacker could acquire the legitimate template and insert hidden instructions that modify the system’s message-handling behavior.
These malicious instructions would be appended to the AI agent’s system prompt in all future interactions, leading to a persistent compromise that is arduous to detect. The model may seem perfectly functional on the surface, retaining normal metadata and capabilities. However, it could be instructed to generate malicious code, recommend risky external packages, or even exfiltrate sensitive data and files.
Broader Implications and Mitigation Strategies
The complications do not end there. While OpenShell sandboxing is intended to minimize direct risks at the host level by implementing various forms of isolation, the actual level of risk hinges on the permissions granted to the AI agent itself. AI agents frequently engage with various sensitive environments, including source repository systems, Continuous Integration/Continuous Deployment (CI/CD) frameworks, internal APIs, and a range of cloud ecosystems.
Moreover, the binding to 0.0.0.0 presents a separate risk; devices sharing the same local network segment could potentially access Ollama directly, bypassing the need for DNS rebinding altogether.
In response to these findings, the researchers promptly reported the vulnerability to NVIDIA’s Product Security Incident Response Team before making their findings public. They emphasized the importance of reviewing exposed interfaces by organizations using NemoClaw and implementing necessary protections. Restrictions should be applied to access port 11434, and a thorough audit of model templates for any unauthorized changes should be conducted.
In summary, the discovery of the CVE-2026-65105 vulnerability underscores the critical need for heightened vigilance and robust security measures within the rapidly evolving landscape of artificial intelligence and its deployment. As cyber threats continue to evolve, so too must the strategies employed to defend against them.