Full Report
Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The findings were shared with The Hacker News ahead of publication, and the report says Oasis Security reported them to NVIDIA's Product Security Incident
Analysis Summary
# Vulnerability: Unauthenticated Remote Model Poisoning in NVIDIA NemoClaw
## CVE Details
- **CVE ID:** None assigned (as of August 25, 2026)
- **CVSS Score:** N/A (Severity likely High due to unauthenticated remote code/instruction injection)
- **CWE:** CWE-94 (Improper Control of Generation of Code), CWE-352 (Cross-Site Request Forgery - via DNS Rebinding)
## Affected Systems
- **Products:** NVIDIA NemoClaw (Open source reference stack for AI agents)
- **Versions:** Installations prior to v0.0.106
- **Configurations:**
- Windows-host installations using Ollama.
- Docker Desktop on WSL2 configurations.
- Any setup where `OLLAMA_HOST` is manually set to `0.0.0.0:11434`.
## Vulnerability Description
The vulnerability stems from a combination of insecure network binding and inadequate request validation in the NemoClaw reference stack.
1. **Insecure Binding:** On certain platforms (specifically Windows and WSL), NemoClaw configures the Ollama daemon to bind to `0.0.0.0:11434` to facilitate container-to-host communication. This exposes the unauthenticated API to the network.
2. **DNS Rebinding:** By bypassing Host and Origin header checks through DNS rebinding, a malicious webpage can interact with the local Ollama API.
3. **Model Poisoning:** The attacker uses the `/api/create` endpoint to overwrite the Go chat template of a local model. This allows the injection of hidden instructions that are appended to every system message at inference time, persisting across all future user sessions.
## Exploitation
- **Status:** PoC available (demonstrated by Oasis Security); No exploitation reported in the wild.
- **Complexity:** Medium (Requires a user to visit a malicious webpage and successful DNS rebinding).
- **Attack Vector:** Network (via browser-based side-channel).
## Impact
- **Confidentiality:** Medium (Attacker can manipulate agent tools to exfiltrate data).
- **Integrity:** High (Attacker gains persistent control over the AI model's behavior and instructions).
- **Availability:** Low (Model remains available but is compromised).
## Remediation
### Patches
- **NemoClaw v0.0.106:** Introduced a security check where the local Ollama proxy refuses to start if the backend is bound to a non-loopback interface.
### Workarounds
- **Strict Binding:** Ensure the Ollama daemon is bound strictly to loopback (`127.0.0.1`) rather than `0.0.0.0`.
- **API Authentication:** Use a reverse proxy (like Nginx or the built-in NemoClaw proxy on non-WSL hosts) to enforce token-based authentication for the Ollama API.
- **Update Ollama:** Ensure Ollama is at least v0.1.29 to mitigate basic DNS rebinding flaws.
## Detection
- **Indicators of Compromise:** Unexpected `OLLAMA_HOST` environment variables set to `0.0.0.0`. Unauthorized modifications to model templates (though these are "invisible" to standard API consumers).
- **Detection methods:** Audit network listeners to ensure port 11434 is not exposed to the local network or the internet. Check Ollama logs for unexpected calls to the `/api/create` endpoint.
## References
- **NVIDIA NemoClaw Documentation:** hxxps[://]docs[.]nvidia[.]com/nemoclaw/user-guide/openclaw/inference/local-inference/set-up-ollama
- **Ollama Integration Guide:** hxxps[://]docs[.]ollama[.]com/integrations/nemoclaw
- **Related Vulnerability (CVE-2024-28224):** hxxps[://]www[.]nccgroup[.]com/research/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/