A hostile web page can take control of the instance Ollama that powers a local agent and rewrite how the model receives messages, leaving hidden instructions that remain active in all subsequent conversations. The problem concerns NemoClawthe open source reference stack with which NVIDIA runs agents like OpenClaw inside OpenShell sandboxes. Oasis Security has rebuilt the chain and no credentials are needed to follow it: the API that governs the local models responds without authentication to anyone who can reach it from the victim’s browser.
The search did not receive an identifier CVE and was reported prior to publication to NVIDIA’s PSIRT, the team that handles product security incidents. As of August 25, 2026, there are no cases of exploitation. Elad Luz, head of research at Oasis Security, points to the v0.0.35 like the version that corrects the problem on macOS and Linux, while on the Windows and WSL path there is no fix: v0.0.34 had added an installation for Windows accompanied by a warning. “Sandboxing protects the endpoint, but taking control of the agent means taking control of its access and tools,” the report reads.
.@cyera_io and @oasissec research teams have found CVE-2026-65105 in @nvidia NemoClaw: one webpage visit gives an attacker full control of the model behind the OpenClaw agent, no credentials needed.
Using DNS rebinding, the attacker reaches the local Ollama API and poisons the…pic.twitter.com/AMmoMhahfw— Cyera (@cyera_io) August 25, 2026
NemoClaw starts Ollama with the variable OLLAMA_HOST=0.0.0.0:11434which makes the model server listen on every network interface. The API on the port 11434 it does not ask for authentication and defends itself from requests arriving from a browser with only two levels of middleware, neither of which holds in this configuration. The first checks the Host header, and is skipped entirely when the listen address is not the loopback address; the second, the CORS layer, treats the request as coming from the same origin, because the Origin and Host headers both carry the attacker’s domain. Applies to a page that the attacker serves on port 11434, and the DNS rebinding it closes the remaining distance: the hostile domain resolves first towards the attacker’s server and then towards 127.0.0.1, while the browser continues to consider requests of the same origin. Luz tested the complete chain on macOS with Firefox, against a vulnerable version of NemoClaw.
Host verification has been around since 2024, but not on 0.0.0.0
DNS rebinding against the Ollama API has been documented for some time. In March 2024 NCC Group reported to the project a vulnerability that allowed a hostile site to drive the API and exfiltrate files from the system, chaining the creation of a model with the ADAPTER statement pointed to a local file and subsequent upload to an attacker-controlled registry. The advisory, published on 8 April 2024 with the identifier CVE-2024-28224indicated three seconds as enough time for the rebinding to succeed once contact with the hostile server has been established. Ollama distributed the correction with the v0.1.29 on March 14, 2024, and NCC Group’s main recommendation was to validate the Host header server-side, accepting only a closed list of authorized values.
That validation has arrived, and according to Luz it arrived precisely in response to the 2024 report, but with a limitation that the NemoClaw case brings to light. “Ollama skips that check every time it listens on an address other than the loopback address, and 0.0.0.0 is exactly how NemoClaw configures it,” he explained. The Ollama and NemoClaw integration page also recommends setting OLLAMA_HOST=0.0.0.0 when working inside WSL2 or a container, and switching to that address has already been identified in the past as the change that makes an instance reachable beyond the local machine.
Once access to the API is obtained, the payload writes via /api/create a modified Go template. The template governs the step in which the structured array of messages becomes raw text, before the model processes it, and the poisoned version adds a text chosen by the attacker at the end of each system message, at the time of inference. Instructions planted in this way remain valid in subsequent conversations and continue to apply even when the agent provides its own system prompt. “The client cannot detect or prevent this: the template is a model-level property, invisible to those consuming the API,” the report reads.
The correct platforms and the one that is left out
The management of Ollama within NemoClaw varies from platform to platform. On hosts that don’t use WSL the daemon remains at 127.0.0.1:11434 behind a tokenized reverse proxy listening on 0.0.0.0:11435, and the startup procedure loopbacks a daemon already listening elsewhere. With Docker Desktop on WSL the proxy is not used, because the container reaches the host’s loopback address via host.docker.internal. The path that keeps Ollama on the Windows host instead sets OLLAMA_HOST=0.0.0.0:11434 so that Docker Desktop containers can talk to the daemon, and on port 11434 it does not require authentication. It should be noted that the report describes that binding as NemoClaw behavior, while NVIDIA documentation and the current source place it on this platform path only.
A repository review at commit 17f0ca3b, conducted on August 25 by The Hacker Newsfound that the local proxy refuses to start against a backend not listening on loopback: this is a default introduced with the v0.0.106 on August 10, which exits the process with a dedicated status code and prompts you to move the daemon back to 127.0.0.1 in Ollama’s systemd drive. The check is deactivated by setting the NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE variable to 1, and on hosts where the binding check cannot be performed it still does not block boot. Above all, the control lives inside the proxy, and on WSL paths the proxy is not started: the protection introduced in August therefore does not reach the platform where the binding to 0.0.0.0 is set. The NVIDIA documentation recommends that those working on the Windows host not expose port 11434 to the local network or the internet, an indication that concerns access arriving from the outside and which the described chain does not need to bypass, given that the browser from which the requests originate already runs on the machine and reaches the daemon on 127.0.0.1.
The same review found no template integrity checks anywhere in the repository: NemoClaw queries /api/show just to know a model’s native context length and declared ability to invoke tools. Poisoning the conversation template for instructions to act during inference is nothing new: Oasis Security has documented the same technique against Paperclip in recent weeks, and in February used a similar browser-to-localhost route to hijack locally running OpenClaw agents. On macOS and Linux the fix has existed since v0.0.35; The warning added with v0.0.34 remains on the Windows path.
