NVIDIA NemoClaw Flaw Lets Malicious Webpages Poison Local AI Models via Ollama

Oasis Security has disclosed a vulnerability in NVIDIA’s NemoClaw, an open-source reference stack for running AI agents, that could allow an attacker-controlled webpage to take unauthenticated control of a local Ollama instance and plant hidden instructions inside the model itself. The issue arises because NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434 on Windows-host paths, binding the model server to all network interfaces without authentication. This exposes the Ollama API on port 11434, which relies on middleware to block browser-originated requests. However, when the bind address is not loopback, the Host header check is skipped, and the CORS layer treats requests as same-origin, allowing a malicious webpage to reach the API. DNS rebinding can also be used to bypass restrictions, as the attacker’s domain resolves first to their server and then to 127.0.0.1 while the browser continues to treat requests as same-origin.

Once the API is reachable, the attacker can modify the model’s chat template via /api/create, appending attacker-controlled text to every system message at inference time. These poisoned instructions persist across conversations and survive the agent supplying its own system prompt. The client cannot detect or prevent this, as the template is a model-level property invisible to API consumers. The vulnerability is related to a previously documented issue in Ollama (CVE-2024-28224), which was fixed in v0.1.29. However, NemoClaw’s current source does not include a chat-template integrity check, and the default bind probe introduced in v0.0.106 does not cover the Windows-host path where the 0.0.0.0 binding is set.

No CVE identifier has been assigned for this NemoClaw issue, and no patched version is available. NVIDIA’s documentation advises operators not to expose port 11434 to a LAN or the internet, but the DNS rebinding chain does not require network exposure, as the browser making the requests is already running on the host. No exploitation has been reported as of August 25, 2026. The Hacker News reviewed the NemoClaw repository and found no chat-template integrity check, with NemoClaw querying Ollama’s /api/show endpoint only for context length and tool-calling capability. Oasis Security has previously documented similar techniques against Paperclip and OpenClaw agents.