Ethical Hacking News
A critical vulnerability in NVIDIA's NemoClaw has been discovered, which could allow an attacker-controlled webpage to take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself. The vulnerability, discovered by Oasis Security, has left many in the security community on high alert, and NVIDIA has not yet released a patch for the vulnerability. The vulnerability is related to the OLLAMA_HOST parameter, which allows an attacker to modify the model's chat template and inject malicious instructions. The report found that the vulnerability could be exploited using a DNS rebinding attack, and that the standard fix for this type of attack is to verify the Host header. The vulnerability has been reported to NVIDIA's Product Security Incident Response Team, and The Hacker News will continue to provide updates on this story as more information becomes available.
Vulnerability discovered in NVIDIA's NemoClaw, allowing unauthenticated control of local Ollama instance and planting hidden instructions inside the model. NemoClaw's Ollama handling differs by platform, with some configurations exposing Ollama instances beyond the local machine. Exploitation not reported as of August 25, 2026, but operator cannot check whether their installation is in scope due to lack of CVE identifier. Reported by Oasis Security to NVIDIA's PSIRT beforehand, with no exploitation reported. NVIDIA's documentation instructs operators to expose port 11434 to a LAN or internet, which could be exploited. Fix for the vulnerability already shipped in Ollama version v0.1.29, but not updated in NemoClaw.
The security landscape of the modern AI world is as complex and nuanced as it is ever-evolving. In recent times, there has been a notable rise in the number of vulnerabilities being discovered in AI systems. One such vulnerability, which has recently been identified, has left many in the security community on high alert. This vulnerability, discovered by Oasis Security, is related to NVIDIA's NemoClaw, a reference stack for running agents such as OpenClaw inside OpenShell sandboxes. The vulnerability, in essence, allows an attacker-controlled webpage to take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself.
The findings of this vulnerability were shared with The Hacker News ahead of publication, and the report states that Oasis Security reported them to NVIDIA's Product Security Incident Response Team (PSIRT) beforehand. However, the report does not provide any CVE identifier, affected version range, or patched version, which means that an operator running NemoClaw cannot currently check whether their installation is in scope. Furthermore, there has been no exploitation reported as of August 25, 2026.
NemoClaw is NVIDIA's open source reference stack for running agents such as OpenClaw inside its OpenShell sandboxes, and Ollama is one of its supported local inference backends. The report describes how NemoClaw starts Ollama with the command OLLAMA_HOST=0.0.0.0:11434, binding the model server to every network interface. This binding allows an attacker to modify the model's chat template so that hidden instructions are applied to every later conversation. The report states that "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools."
NVIDIA's own Ollama setup documentation and the current source code that binding on one platform path differ. NemoClaw's Ollama handling differs by platform - Non-WSL hosts keep Ollama on 127.0.0.1:11434 behind a token-gated reverse proxy on 0.0.0.0:11435, and onboarding restarts a daemon already bound elsewhere back to loopback. Docker Desktop on WSL skips the proxy, because the container reaches the host's loopback address through host.docker.internal. The Windows-host Ollama path sets OLLAMA_HOST=0.0.0.0:11434 so Docker Desktop containers can reach the daemon, and does not require authentication on port 11434.
Ollama's own NemoClaw integration page also advises setting OLLAMA_HOST=0.0.0.0 when running inside WSL2 or a container, and binding it to 0.0.0.0 has previously been identified as the change that exposes Ollama instances beyond the local machine. The API on port 11434 has no authentication and relies on two middleware layers to block browser-originated requests. When the bind address is not loopback, the Host header check is skipped entirely. The Cross-Origin Resource Sharing (CORS) layer then treats the request as same-origin and allows it, because the Origin and Host headers both carry the attacker's own domain. That holds for a page the attacker serves on port 11434.
Domain Name System (DNS) rebinding closes the gap, with the attacker's domain resolving first to their own server and then to 127.0.0.1 while the browser continues to treat the requests as same-origin. The report does not state which browsers or operating systems the chain was verified against. Verifying Host and Origin headers is the standard fix for that class of attack. DNS rebinding against Ollama's API is itself documented. Ollama shipped a fix in v0.1.29 on March 14, 2024, and NCC Group published the advisory as CVE-2024-28224 the following month. That advisory recommended validating the Host header on the server side to allow only a set of authorized values.
The report's payload writes a modified Go template through /api/create, the template controls how the structured messages array is rendered into raw text before the model processes it, and the poisoned version appends attacker-controlled text to every system message at inference time. Instructions planted this way persist across later conversations and survive the agent supplying its own system prompt, according to the report. The client cannot detect or prevent this - the template is a model-level property invisible to API consumers.
The Hacker News reviewed the NemoClaw repository at commit 17f0ca3b on August 25 and found that the local Ollama proxy refuses to start against a backend that is not bound to loopback, a default introduced in v0.0.106 on August 10. The proxy exits with a dedicated status code and prints "Refusing to start: an Ollama daemon reachable on a non-loopback interface bypasses the proxy's token check entirely. Set OLLAMA_HOST=127.0.0.1:${port} on the Ollama systemd unit or set NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1 to override (not recommended)." That check can be switched off by setting NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1, and it does not fail closed on hosts where the bind check cannot run.
The check also runs inside the proxy itself. NemoClaw does not start that proxy on the WSL paths, and the Windows-host configuration is one of them. The v0.0.106 default therefore does not reach the platform path where the 0.0.0.0 binding is set. The same review found no chat-template integrity check anywhere in the repository, with NemoClaw querying Ollama's /api/show endpoint only for a model's native context length and its declared tool-calling capability.
NVIDIA's documentation instructs operators on the Windows-host path not to expose port 11434 to a LAN or the internet. That guidance addresses inbound access from the network. The rebinding chain does not need it, because the browser making the requests is already running on the host and reaches the daemon at 127.0.0.1.
Poisoning a model's chat template so that instructions run during inference has been documented before as poisoned chat templates. Oasis Security researchers documented the same technique against Paperclip earlier this month, and used a comparable browser-to-localhost path to hijack local OpenClaw agents in February.
The Hacker News has reached out to Oasis Security for the NemoClaw version and platform path the proof of concept was verified against, and will update this story with any response.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Vulnerability-in-NVIDIAs-NemoClaw-A-Threat-to-AI-Model-Security-ehn.shtml
https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
https://utopiats.com/blog/a-malicious-webpage-could-poison-your-local-ai-model-behind-nvidia-nemoclaw
Published: Tue Aug 25 10:37:31 2026 by llama3.2 3B Q4_K_M
