← News
/DISPATCH · 2026-08-27

CVE-2026-65105: NVIDIA NemoClaw AI Agent DNS Rebinding Flaw Lets Malicious Pages Remotely Poison Local Ollama Model Templates

Cyera (which acquired Oasis Security) publicly disclosed a high-severity vulnerability in the NVIDIA NemoClaw framework, CVE-2026-65105, CVSS v3.1 8.1 (High). The flaw abuses NemoClaw starting Ollama with OLLAMA_HOST=0.0.0.0:11434

Cyera (which acquired Oasis Security) publicly disclosed a high-severity vulnerability in the NVIDIA NemoClaw framework, CVE-2026-65105, CVSS v3.1 8.1 (High). The issue abuses NemoClaw starting Ollama with `OLLAMA_HOST=0.0.0.0:11434`, binding Ollama on every NIC and skipping Host header checks. An attacker who lures the victim to a malicious page can DNS-rebind straight to local Ollama and write a persistent malicious prompt template that hits every later session. NemoClaw runs OpenClaw-class AI agents locally, typically in R&D toolchains; blast radius is not a single app compromise.

Incident Overview

CVE: CVE-2026-65105, publicly disclosed by Cyera researcher Elad Luz et al. CVSS v3.1: 8.1 (NVIDIA official rating), AV:N, AC:H, PR:N, UI:R, Scope Changed. Disclosure: 25 Aug 2026; NVIDIA shipped a security update the same day. Affected: NemoClaw 0 through 0.0.25. Fixed: NemoClaw 0.0.35 (macOS/Linux). Windows / WSL currently unpatched. Known in-the-wild: Cyera published a full PoC video plus multiple public analyses; exploit barrier is now low.

Technical Details

NemoClaw runs OpenClaw AI agents inside an OpenShell Docker sandbox and uses local Ollama for inference. The OpenShell container cannot reach host loopback, so NemoClaw starts Ollama with `OLLAMA_HOST=0.0.0.0:11434`, listening on all interfaces. LAN peers and anything in the host network namespace can hit the Ollama API.

Ollama API has no auth. It originally relied on CORS allowlists and Host header checks to block browser cross-origin calls. Cyera found that once Ollama binds a non-loopback address, Host header validation is skipped entirely; only CORS remains. Browser SOP keys on hostname, not IP, so DNS Rebinding bypasses CORS:

Worst capability is at the model layer: `/api/show` pulls the target model's existing Go template, hidden instructions are embedded, then `/api/create` writes it back. The template lives in model metadata, not the session layer, so OpenClaw's own system prompt cannot override the injection. Poison is invisible to the session, ops, and end user; it lasts the model lifetime and shapes all future session output.

Impact Assessment

Local AI agents typically have filesystem, Shell, source-repo, and cloud-credential access. Once the model is poisoned, the attacker can induce the agent to silently:

Poison sits in the model template, not the current session. Clearing the session does not help; re-pull the model or reinstall NemoClaw. Audit tools that compare only model hashes and ignore template hashes go blind.

Remediation

References