NVIDIA NemoClaw Flaw Lets Malicious Webpages Poison Local AI Models
This digest was compiled by AI from multiple sources — links to the originals are below.
Oasis Security disclosed a vulnerability in NVIDIA NemoClaw that allows an attacker-controlled webpage to take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model. The flaw was reported to NVIDIA's PSIRT, and no exploitation has been observed as of August 25, 2026. NemoClaw v0.0.35 fixes the issue on macOS and Linux, while the Windows and WSL path remains unfixed.
Key Facts
- Oasis Security disclosed the vulnerability to NVIDIA's PSIRT before publication, and no CVE identifier has been assigned.
- NemoClaw v0.0.35 fixes the issue on macOS and Linux, but the Windows and WSL path remains unfixed as of August 25, 2026.
- The vulnerable configuration binds Ollama to 0.0.0.0:11434, exposing the API without authentication.
- DNS rebinding allows an attacker's domain to resolve to 127.0.0.1, bypassing browser origin checks and enabling same-origin requests to the local API.
- The full attack chain was tested on macOS with Firefox against a vulnerable NemoClaw version.
Vulnerability Disclosure
Oasis Security reported the flaw to NVIDIA's Product Security Incident Response Team before publishing its findings. The research carries no CVE identifier, and no exploitation has been reported as of August 25, 2026. NemoClaw v0.0.35 fixed the issue on macOS and Linux, according to Oasis Security's head of research, Elad Luz. The Windows and WSL path remains unfixed, where v0.0.34 added a Windows installation that carries a warning instead.
Technical Mechanism
NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the model server to every network interface. The API on port 11434 has no authentication and relies on two middleware layers to block browser-originated requests. When the bind address is not loopback, the Host header check is skipped entirely. The Cross-Origin Resource Sharing layer then treats the request as same-origin and allows it, because the Origin and Host headers both carry the attacker's own domain. DNS rebinding closes the gap, with the attacker's domain resolving first to their own server and then to 127.0.0.1 while the browser continues to treat the requests as same-origin.
Platform Differences
Non-WSL hosts keep Ollama on 127.0.0.1:11434 behind a token-gated reverse proxy on 0.0.0.0:11435. Docker Desktop on WSL skips the proxy, because the container reaches the host's loopback address through host.docker.internal. The Windows-host Ollama path sets OLLAMA_HOST=0.0.0.0:11434 so Docker Desktop containers can reach the daemon, and does not require authentication on port 11434. Ollama's own NemoClaw integration page also advises setting OLLAMA_HOST=0.0.0.0 when running inside WSL2 or a container.
3 sources
NVIDIA NemoClaw Flaw Lets Malicious Webpages Poison Local AI Models
