August 25, 2026 — Cyera's Oasis Security research disclosed CVE-2026-65105 in NVIDIA NemoClaw: a local AI deployment choice that turns your Ollama backend into a drive-by hijack surface. One visit to a malicious webpage can enumerate models, rewrite chat templates, and leave persistent hidden instructions that survive the agent's own system prompt — no traditional malware download required.
NemoClaw exists so developers can run OpenClaw-class agents on DGX Station and OpenShell sandboxes with local Nemotron weights. The vulnerability is not "LLMs are insecure." It is 0.0.0.0 binding meeting browser DNS rebinding.
TL;DR — what people are asking
| Question | Answer |
|---|---|
| CVE? | CVE-2026-65105 |
| Disclosed? | Aug 25, 2026 — Cyera / Oasis → NVIDIA PSIRT |
| Root cause? | Ollama on 0.0.0.0:11434, no auth, Host checks weakened |
| Attack? | DNS rebinding from malicious page → full Ollama API |
| Impact? | Model template poisoning; LAN neighbors can also hit API |
| Fixed? | NemoClaw v0.0.35 (macOS/Linux); Windows gap reported |
| Malware needed? | No — browser visit while agent running |
How the attack chain works
Cyera's write-up walks a four-step PoC:
- Developer runs NemoClaw + OpenClaw — agent answers normally.
- Same machine opens an attacker page performing DNS rebinding to
127.0.0.1. - Page calls Ollama API — lists models, pulls version, injects template text.
- Developer returns to agent — responses include attacker marker; injection persists across prompts.
Because NemoClaw binds Ollama for container reachability, the API is also exposed to any device on the LAN without rebinding — port 11434 becomes a shared unauthenticated endpoint.
Dark Reading and The Hacker News confirmed Firefox on macOS PoC success pre-patch; Linux matched until v0.0.35.
What this means for what you build or pay
Local-first agent stacks trade cloud API risk for host networking risk. If you ship NemoClaw blueprints to customers, you are shipping inference surface area — audit binds before praising "data never leaves the laptop."
Template poisoning is worse than prompt injection in one session: poisoned templates sit below the harness system prompt in the demonstrated chain, so your CLAUDE.md / AGENTS.md guardrails may not see the compromised layer.
Compliance teams evaluating Siggraph NemoClaw demos should add network hardening to pilot requirements — not optional for production pilots.
Mitigation checklist (do today)
# Verify Ollama bind — should NOT be 0.0.0.0 in production dev machines
lsof -i :11434
# Prefer loopback-only (example systemd override or launch flag)
OLLAMA_HOST=127.0.0.1:11434 ollama serve
- Upgrade NemoClaw to v0.0.35+ on macOS/Linux.
- Windows/WSL — assume exposed until NVIDIA confirms patch; do not expose 11434.
- Put auth in front — reverse proxy with token even on localhost multi-user machines.
- Firewall LAN — block inbound 11434 on office Wi-Fi for developer laptops.
- Re-pull models if you suspect compromise — attacker PoC included model manipulation APIs.
NemoClaw vs generic Ollama risk
| Setup | Default bind | CVE-2026-65105 class |
|---|---|---|
| NemoClaw + OpenShell | 0.0.0.0 (pre-patch) | Yes — documented |
| Manual Ollama | Often 127.0.0.1 | Only if you chose 0.0.0.0 |
| DGX Spark local stack | Varies by script | Audit DGX Spark guide |
Honest limitations
- Windows patch status was unclear at disclosure — re-check NVIDIA release notes before declaring green.
- No widespread exploitation reported yet — risk is configuration prevalence among early NemoClaw adopters.
- Other backends (non-Ollama) were not in scope for this CVE — still audit any local OpenAI-compatible port.
- Browser-dependent — rebinding PoCs vary by browser DNS cache behavior; LAN access does not.
Related on explainx.ai
- NVIDIA Siggraph 2026 — NemoClaw and DGX Station
- What is OpenClaw?
- OpenClaw foundation 501(c)(3)
- NVIDIA DGX Spark local LLM setup
- MCP security guide
- AGENTS.md code quality and hooks
- Four AI agent security incidents
- Fake Codex Google Ads AMOS campaign
CVE status and NemoClaw version numbers accurate as of August 26, 2026 — confirm against NVIDIA security advisories before compliance sign-off.