A single visit to a malicious webpage is all it takes to silently rewrite the brain of your local AI agent. Oasis Security disclosed CVE-2026-65105 today: an attacker can take unauthenticated control of the Ollama model server inside NVIDIA’s NemoClaw, overwrite its chat template with hidden instructions, and poison every conversation the agent has — permanently and invisibly, with no credentials required.
The Configuration Decision That Opened the Door #
NemoClaw launches Ollama with OLLAMA_HOST=0.0.0.0:11434
. That single flag binds the model API to every network interface on the machine. Here is the problem: Ollama skips Host header validation when bound to a non-loopback address. Bind to 127.0.0.1 and the browser’s same-origin policy keeps outside requests out. Bind to 0.0.0.0 and DNS rebinding turns any webpage into a direct line to your local inference server.
This is not a subtle misconfiguration buried in an advanced settings menu. NemoClaw set it by default, for every user, on every supported platform.
How the Attack Works #
DNS rebinding is a well-understood technique. The attacker’s domain resolves to their own server first, then quickly resolves to 127.0.0.1 while the browser still treats subsequent requests as same-origin. With Ollama listening on 0.0.0.0, those requests land.
Once the attacker’s JavaScript can reach localhost:11434
, the rest is straightforward:
-
Pull the model’s existing Go template via
/api/show -
Inject a hidden instruction into the template
-
Write the poisoned template back via
/api/create
From that point forward, every message the NemoClaw agent processes passes through the attacker’s version of the template. The attacker’s instruction is appended to every system prompt at inference time — silently, on every conversation. The agent client has no visibility into this. As Oasis Security put it: “The client cannot detect or prevent this — the template is a model-level property invisible to API consumers.”
What a Poisoned Agent Can Do #
The severity here comes from what AI agents are authorized to do. NemoClaw agents typically have access to your filesystem, shell, source control repositories, and cloud credentials. A poisoned model can be directed to exfiltrate files, leak API keys, or silently modify code — all while the developer sees what appear to be normal responses. The poisoning persists until the model is re-pulled or NemoClaw is fully reinstalled.
Patch Status: Mac and Linux Fixed, Windows Still Exposed #
NemoClaw v0.0.35 resolves the issue on macOS and Linux. The fix is architectural: Ollama now runs on 127.0.0.1:11434
(loopback only), and a token-gated reverse proxy handles any traffic that legitimately needs external access on 0.0.0.0:11435
. DNS rebinding from a browser can no longer reach the Ollama API directly.
Windows and WSL users have no fix. NemoClaw v0.0.34 added Windows support with a warning about the exposure — not a remediation. There is no published timeline for a Windows fix. If you are running NemoClaw on Windows or WSL, assume you are currently exposed.
Check Your Binding Right Now #
If you use NemoClaw or run Ollama independently, verify your binding before your next browser session:
sudo ss -tupln | grep ollama
sudo lsof -i :11434
If you see 0.0.0.0
and you are not on NemoClaw v0.0.35+, update immediately. If you cannot update yet, or you are on Windows, force the correct binding manually:
OLLAMA_HOST=127.0.0.1:11434 ollama serve
This Is a Pattern, Not an Anomaly #
DNS rebinding against local AI servers is not a new discovery. NCC Group documented the same class of attack against Ollama in CVE-2024-28224. Varonis covered it for MCP servers earlier this year. The common thread: developers assume that “running locally” means “running safely.” It does not.
Local AI tools inherit all the attack surface of any service listening on a port — and they are increasingly paired with agent frameworks that have significant system-level access. The question to ask about every local AI tool in your stack is not “is it local?” but “what port is it on, and who can reach it?”
Update NemoClaw. Check your Ollama binding. And if you are on Windows, treat this as active exposure until a patch ships. Full technical details are available in Oasis Security’s disclosure.