A DNS rebinding flaw could give attackers unauthenticated access to NemoClaw’s local Ollama server and let them plant instructions that persist across future conversations.
A vulnerability affecting Nvidia’s NemoClaw could let an attacker gain control of the local Ollama model server through a single malicious website visit on the victim’s machine.
According to a Cyera research, the flaw could give attackers unauthenticated access to the server, allowing them to plant instructions into the model that persist across future conversations. The attacker doesn’t directly connect to the victim’s Ollama server from the internet. Instead, the malicious webpage tricks the browser into reaching the locally running Ollama API through DNS rebinding.
Once that happens, the model’s chat template, a layer that controls how messages are presented to the model, is manipulated to add malicious instructions to the agent’s system prompts.
“With CVE-2026-65105, an attacker can alter how NemoClaw’s model reads every message it’s handed — one layer beneath anything a guardrail or an operator can see — and the change survives every future session, leaving an integrity problem that’s very hard to detect,” said Elad Luz, head of research at Oasis Security, which is being acquired by Cyera. “The broader trend is that agents are becoming identities with real entitlements, and we’re still securing them like tools.”
The flaw has now been patched by Nvidia for non-Windows systems.
DNS Rebinding breaks Ollama out of local walls
NemoClaw is designed to run the OpenClaw AI agent inside Nvidia’s OpenShell sandbox. For local inference, NemoClaw can use Ollama, allowing models to run on the developer’s own machine rather than sending prompts and code to a cloud service.
The problem starts with networking. Because the OpenShell sandbox runs inside a Docker container, it cannot reach an Ollama service listening only on the loopback address, 127.0.0.1. NemoClaw therefore starts Ollama with “OLLAMA_HOST=0.0.0.0:11434,” making it listen on all network interfaces.
That solves the container connectivity problem but also disables an important Ollama protection. Ollama’s API does not require authentication and normally uses CORS and Host-header checks to prevent unauthorized browser access. But when Ollama is bound to a non-loopback address, its Host-header validation is skipped.
An attacker can then use DNS rebinding to make a malicious webpage initially resolve to the attacker’s server and subsequently resolve to 127.0.0.1 or a local network address. The browser would still consider the requests to belong to the attacker-controlled hostname, but Ollama would receive them, resulting in unauthenticated access to the local API.
“The individual pieces here aren’t new,” said Randolph Barr, Chief Information Security Officer at Cequence Security. “DNS rebinding’s been a browser party trick for over a decade, but pointing it at an unauthenticated local model server is the new part.”
Cyera found that an attacker could enumerate installed models and Ollama’s version, retrieve model details and system prompts, delete models, download large models to consume disk space, and otherwise manipulate the local Ollama installation.
The poisoned template refuses to go away
The more serious problem is what happens after API access is obtained.
Cyera tested injecting malicious instructions through Ollama’s model configuration. A straightforward system-prompt injection was not enough because OpenClaw supplies its own system prompt when communicating with the model. The researchers thus targeted the model’s chat template instead.
Modifying the template could let the attacker preserve the model’s original behavior while appending their own instructions to system messages. Because the modification was done at the model level, the OpenClaw agent does not see it and cannot override it with its own system prompt.
The poisoned template persists across future conversations and remains invisible in the model’s ordinary metadata, the researchers found.
The exposure depends on what the compromised agent is allowed to access. Cyera said injected instructions could potentially push an agent toward attacker-controlled packages or URLs, suppress security warnings, introduce vulnerable code, or exfiltrate information through available network access.
NemoClaw version 0.0.35 carries patches for macOS and Linux systems, while Windows/WSL remains unfixed. Nvidia did not immediately respond to CSO’s request for comments.