NVIDIA NemoClaw vulnerability allows remote model poisoning via DNS rebinding
Researchers disclosed a vulnerability (CVE-2026-65105) in NVIDIA's NemoClaw framework that allows attackers to permanently alter a developer's locally-running AI model by visiting a malicious webpage, exploiting DNS rebinding and weak binding configurations in the Ollama backend to inject hidden instructions into the model's chat template.
What happened
Security researchers at Oasis Security disclosed CVE-2026-65105 on August 25, 2026, a vulnerability in NVIDIA's NemoClaw framework affecting the Windows-host Ollama deployment path. A single visit to an attacker-controlled webpage can exploit a chain of three weaknessesβwide network binding (OLLAMA_HOST=0.0.0.0:11434), bypassed authentication via skipped Host header validation, and an unguarded model customization endpointβto inject hidden instructions into a model's chat template.
The attack uses DNS rebinding to bypass origin checks: an attacker-controlled domain first points to the attacker's server, then re-resolves to 127.0.0.1, allowing malicious requests to reach the victim's Ollama instance. The injected instructions persist in the chat template, a Go-language component operating below the API layer that controls message formatting before the model processes it.
Unlike session-layer prompt injection affecting only the current conversation, chat template poisoning persists across all future conversations, survives reboots, and survives client-supplied system prompts because it operates beneath any layer that API consumers, client applications, or security tools can observe.
Reported impact
The vulnerability grants attackers full API access to the local model server, allowing enumeration of installed models, extraction of the machine's hostname and public key, model deletion, and permanent alteration of model behavior.
As of the disclosure date, the vulnerability remained unpatched on Windows-host NemoClaw deployments and generated no file-system artifacts, anomalous processes, or alerts from standard endpoint detection and response tools.
Index analysis
NVIDIA announced NemoClaw at GTC 2026 in March as an enterprise-hardened deployment stack for deploying AI agents inside OpenShell sandboxes with network guardrails and governance policies. NemoClaw supports local inference through Ollama to allow developers to run large language models on their own hardware without sending data to cloud services.
The vulnerability stems directly from NemoClaw's design choice to bind Ollama to 0.0.0.0:11434 on Windows hosts to enable Docker Desktop containers running inside Windows Subsystem for Linux to communicate with the Ollama daemon, combined with Ollama's lack of built-in API authentication and reliance on Host header validation that NemoClaw's configuration bypasses.
Governance controls
NVIDIA stated it had issued an update that customers can download and install following Coordinated Vulnerability Disclosure best practices. Oasis Security reported the vulnerability to NVIDIA's Product Security Incident Response Team before public disclosure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.