Press play to start listening
Oasis Identity Research, now part of Cyera, has disclosed a vulnerability in NVIDIA NemoClaw that can give an attacker unauthenticated control of the local Ollama model server after the user visits a malicious webpage. The firm identifies the issue as CVE-2026-65105 in comments shared with Hackread.com.
NemoClaw is an open-source tool for running the OpenClaw AI agent inside an NVIDIA OpenShell sandbox, with Ollama available for local model inference. The sandbox limits the agent’s access to the host system, but Oasis found that NemoClaw’s Ollama configuration exposes a separate route to the model that guides the agent
How One Webpage Reaches Local Ollama
Problems begin when NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434 so an OpenShell container can reach it. Although the installer tells users it is using Ollama on localhost:11434, the service listens on every network interface. Ollama’s API has no built-in authentication.
Ollama normally uses browser-origin checks and Host header validation to stop remote websites from calling local services. Its Host check is skipped when the service binds to a non-loopback address such as 0.0.0.0, leaving the origin check as the remaining barrier.
An attacker can bypass that barrier through DNS rebinding. A malicious domain first directs the browser to the attacker’s server, then changes its DNS response to the victim’s local address. The browser continues treating requests as belonging to the same site, allowing the webpage to call the local Ollama API without a password.
Once connected, the page can list installed models, read their templates and system prompts, obtain the machine hostname and Ollama public key, run prompts on the victim’s GPU, download or delete models, fill storage and force an Ollama sign-out. Devices on the same local network can also contact the exposed API directly.
Hidden Instructions Reach Every Conversation
The more serious attack uses Ollama’s /api/create endpoint to alter a model’s chat template. A chat template turns messages and roles into the final text processed by the model. By changing it, an attacker can add a hidden instruction to every system message while keeping the model’s normal formatting and behaviour.
A normal system-prompt injection would be replaced when OpenClaw sends its own instructions. Template poisoning survives because it is applied after the agent submits those instructions. The model therefore receives the legitimate prompt together with the attacker’s command during every later conversation.
Elad Luz, head of research at Oasis Security, told Hackread.com that the change occurs “one layer beneath anything a guardrail or an operator can see.” He said the agent’s permissions, including access to source control and cloud services, determine how much harm the poisoned model can cause.
If those connections are available, the model could insert vulnerable code, hide security warnings, recommend attacker-controlled packages or send accessed information to an external server. OpenShell may still isolate local processes and files, but it cannot stop an authorised agent from misusing tools and accounts it has been permitted to access.
Report Sent to NVIDIA
Oasis said it reported the findings to NVIDIA’s Product Security Incident Response Team before publication. The report provided to Hackread.com does not identify a fixed release or state that attacks have occurred outside the research demonstration.
Ram Varadarajan, chief executive at Acalvio, said organisations should treat an AI agent as inheriting the trust and weaknesses of every system it can access. He recommended network isolation, least privilege, continuous monitoring and model-aware decoys.
NemoClaw users running local Ollama should prevent untrusted access to port 11434, avoid binding an unauthenticated service to every interface, restrict the agent’s organisational permissions and inspect model templates for unauthorised changes.
