Affected Systems
NVIDIA NemoClaw versions prior to v0.0.35 on macOS and Linux. Windows and WSL installations remain vulnerable as of v0.0.34, which added a warning but no technical fix. Affects deployments using local Ollama instances with NemoClaw, particularly Windows-host Docker Desktop configurations binding Ollama to 0.0.0.0:11434.
Exploitation Status
No active exploitation reported as of August 25, 2026. Proof-of-concept demonstrated by Oasis Security on macOS with Firefox using DNS rebinding to inject malicious chat templates into Ollama models. Attack chain is documented and technically feasible.
Business Impact
An attacker-controlled webpage can exploit DNS rebinding to gain unauthenticated access to the local Ollama API on vulnerable NemoClaw installations. The attacker can modify the AI model's chat template to inject persistent hidden instructions that execute during every subsequent inference, effectively poisoning the model's behavior. This bypasses NemoClaw's sandboxing protections by compromising the agent itself, granting access to its tools and permissions. Windows and WSL users face ongoing risk with no technical mitigation available. No CVE assigned.
Urgency
🟠Within 24 hours
Recommended Actions
- Upgrade NemoClaw to v0.0.35 or later on macOS and Linux systems immediately
- On Windows and WSL installations, do not expose Ollama port 11434 to any network and restrict browser access to untrusted websites on systems running NemoClaw
- Verify Ollama is bound to 127.0.0.1:11434 (loopback only) rather than 0.0.0.0:11434 by checking OLLAMA_HOST environment variable and systemd unit configurations
- Monitor Ollama API logs for unexpected /api/create requests that modify model chat templates, particularly from local browser processes
- Consider disabling local Ollama instances on Windows/WSL NemoClaw deployments until a technical fix is released, or isolate them on dedicated non-browsing workstations