Overview
Oasis Security has disclosed a vulnerability in NVIDIA’s NemoClaw — an open-source reference stack for running AI agents such as OpenClaw inside OpenShell sandboxes — that allows a malicious webpage to silently take control of a user’s local Ollama inference server and permanently alter the AI model’s behaviour. The flaw was reported to NVIDIA PSIRT ahead of publication and carries no CVE identifier. No in-the-wild exploitation has been confirmed as of 25 August 2026. A partial fix shipped in NemoClaw v0.0.35 for macOS and Linux; Windows and WSL remain vulnerable.
Technical Analysis
The vulnerability stems from NemoClaw’s Windows-host configuration setting OLLAMA_HOST=0.0.0.0:11434, which binds the Ollama model server to every available network interface rather than loopback only. The Ollama API on port 11434 relies on two middleware layers for security: a Host header check and a CORS layer. When the bind address is not loopback, the Host header check is skipped entirely. The CORS layer then misclassifies the request as same-origin when the attacker’s domain is served on port 11434, because both the Origin and Host headers carry the attacker-controlled domain.
DNS rebinding closes the remaining gap: the attacker’s domain first resolves to their own server, then re-resolves to 127.0.0.1 while the browser maintains the same-origin context. This allows the attacker’s page to issue arbitrary, unauthenticated API calls to the local Ollama instance. The critical consequence is that the attacker can overwrite the model’s chat template, embedding hidden system instructions that persist across all future conversations without the user’s knowledge.
Oasis Security’s Elad Luz confirmed the full chain was tested on macOS with Firefox against a vulnerable NemoClaw build.
# Vulnerable configuration path (Windows host)
export OLLAMA_HOST=0.0.0.0:11434 # No auth, Host check disabled
# Patched configuration (non-WSL)
OLLAMA_HOST=127.0.0.1:11434 # Behind token-gated reverse proxy on :11435
On non-WSL hosts, the patched stack keeps Ollama on 127.0.0.1:11434 behind a token-gated reverse proxy on 0.0.0.0:11435. Docker Desktop on WSL uses host.docker.internal to reach the host loopback, bypassing the proxy.
Framework Mapping
- AML.T0018 (Manipulate AI Model) and AML.T0080 (AI Agent Context Poisoning): The attacker modifies the chat template to inject persistent hidden instructions into every agent interaction.
- AML.T0040 (AI Model Inference API Access): Unauthenticated API access is the core enabler.
- AML.T0051 (LLM Prompt Injection) and AML.T0067 (LLM Trusted Output Components Manipulation): Hidden instructions manipulate model outputs from a position of implicit trust.
- LLM01 (Prompt Injection) and LLM03 (Training Data Poisoning): The chat template modification constitutes persistent prompt-level poisoning affecting all downstream outputs.
Impact Assessment
Users running NemoClaw on Windows or WSL with Ollama are most directly exposed. Because the poisoned chat template applies to every subsequent conversation, the impact extends beyond the initial attack moment — any tools, data, or decisions mediated by the agent can be silently influenced. As Oasis Security noted, compromising the agent effectively grants access to all its connected tools and capabilities, regardless of endpoint sandboxing.
Mitigation & Recommendations
- Upgrade immediately to NemoClaw v0.0.35 on macOS and Linux.
- On Windows and WSL, manually restrict Ollama to
127.0.0.1:11434and place an authenticated reverse proxy in front of any externally reachable port until an official patch ships. - Audit all Ollama deployments for
OLLAMA_HOST=0.0.0.0settings, including those recommended by third-party integration guides. - Implement Host and Origin header validation at the Ollama API layer as a defence-in-depth measure.
- Monitor chat template integrity — establish a baseline and alert on unexpected modifications.