NVIDIA NemoClaw CVE-2026-65105: One Webpage Can Poison Local Ollama

August 25, 2026 — Cyera's Oasis Security research disclosed CVE-2026-65105 in NVIDIA NemoClaw: a local AI deployment choice that turns your Ollama backend into a drive-by hijack surface. One visit to a malicious webpage can enumerate models, rewrite chat templates, and leave persistent hidden instructions that survive the agent's own system prompt — no traditional malware download required.

NemoClaw exists so developers can run OpenClaw-class agents on DGX Station and OpenShell sandboxes with local Nemotron weights. The vulnerability is not "LLMs are insecure." It is 0.0.0.0 binding meeting browser DNS rebinding.

TL;DR — what people are asking

How the attack chain works

Cyera's write-up walks a four-step PoC:

1. Developer runs NemoClaw + OpenClaw — agent answers normally.
2. Same machine opens an attacker page performing DNS rebinding to 127.0.0.1.
3. Page calls Ollama API — lists models, pulls version, injects template text.
4. Developer returns to agent — responses include attacker marker; injection persists across prompts.

Because NemoClaw binds Ollama for container reachability, the API is also exposed to any device on the LAN without rebinding — port 11434 becomes a shared unauthenticated endpoint.

Dark Reading and The Hacker News confirmed Firefox on macOS PoC success pre-patch; Linux matched until v0.0.35.

What this means for what you build or pay

Local-first agent stacks trade cloud API risk for host networking risk. If you ship NemoClaw blueprints to customers, you are shipping inference surface area — audit binds before praising "data never leaves the laptop."

Template poisoning is worse than prompt injection in one session: poisoned templates sit below the harness system prompt in the demonstrated chain, so your CLAUDE.md / AGENTS.md guardrails may not see the compromised layer.

Compliance teams evaluating Siggraph NemoClaw demos should add network hardening to pilot requirements — not optional for production pilots.

Mitigation checklist (do today)

# Verify Ollama bind — should NOT be 0.0.0.0 in production dev machines
lsof -i :11434

# Prefer loopback-only (example systemd override or launch flag)
OLLAMA_HOST=127.0.0.1:11434 ollama serve

1. Upgrade NemoClaw to v0.0.35+ on macOS/Linux.
2. Windows/WSL — assume exposed until NVIDIA confirms patch; do not expose 11434.
3. Put auth in front — reverse proxy with token even on localhost multi-user machines.
4. Firewall LAN — block inbound 11434 on office Wi-Fi for developer laptops.
5. Re-pull models if you suspect compromise — attacker PoC included model manipulation APIs.

NemoClaw vs generic Ollama risk

Honest limitations

• Windows patch status was unclear at disclosure — re-check NVIDIA release notes before declaring green.
• No widespread exploitation reported yet — risk is configuration prevalence among early NemoClaw adopters.
• Other backends (non-Ollama) were not in scope for this CVE — still audit any local OpenAI-compatible port.
• Browser-dependent — rebinding PoCs vary by browser DNS cache behavior; LAN access does not.

Related on explainx.ai

• Update — September 28, 2026: NVIDIA's Open Agent Safety Platform formalizes OpenShell as the trust layer NemoClaw-style stacks should inherit — patch networking bugs and adopt runtime policy.
• NVIDIA Siggraph 2026 — NemoClaw and DGX Station
• What is OpenClaw?
• OpenClaw foundation 501(c)(3)
• NVIDIA DGX Spark local LLM setup
• MCP security guide
• AGENTS.md code quality and hooks
• Four AI agent security incidents
• Fake Codex Google Ads AMOS campaign

CVE status and NemoClaw version numbers accurate as of August 26, 2026 — confirm against NVIDIA security advisories before compliance sign-off.