NemoClaw's wide Ollama bind lets a webpage rewrite your model's chat template
Oasis Security says a malicious page can reach the unauthenticated API on port 11434 and poison every later conversation. NVIDIA's own source puts that bind on one platform path.
The Watch · Security desk
What happened
- Oasis Security says an attacker-controlled webpage can take unauthenticated control of the Ollama instance serving a NemoClaw agent and plant hidden instructions in the model.
- The payload writes a modified Go chat template through /api/create, so attacker text is appended to every system message at inference time.
- Oasis reported the findings to NVIDIA's PSIRT before sharing them with The Hacker News ahead of publication.
- There is no CVE identifier, no affected version range and no patched version, so an operator cannot check whether their install is in scope.
- No exploitation had been reported as of August 25, 2026.
Why it matters
- exposure Oasis Security's framing is that sandboxing protects the endpoint while taking over the agent takes over its access and tools, so a contained process says nothing about what its credentials still...
- constraint Oasis says the template is a model-level property invisible to API consumers, which puts client-side prompt inspection and response filtering in the wrong place to see the injected text.
- contradiction The report describes NemoClaw binding Ollama to every interface, while NVIDIA's documentation and current source put that on a single platform path, so the two accounts imply very different...
- precedent Ollama's own integration page tells WSL2 and container users to set OLLAMA_HOST=0.0.0.0, which makes the exposed configuration documented practice rather than operator error, and the next bundler...
The header-validation fix for this class of bug already shipped once. Ollama closed DNS rebinding against its API in v0.1.29 on March 14, 2024, and NCC Group published it as CVE-2024-28224 the following month, with the recommendation to validate the Host header on the server against a set of authorized values [15]. About 29 months later the same door is open, and not because anyone reverted the code [24]. The API on 11434 has no authentication and leans on two middleware layers to keep browsers out; when the bind address is not loopback, the Host check is skipped outright, and the CORS layer then reads Origin and Host as the same attacker-controlled domain and permits the call [10][11]. Where the attacker cannot serve their page on 11434 itself, rebinding covers it: their domain resolves to their server, then to 127.0.0.1, while the browser goes on treating the requests as same-origin [12]. A bind address decided which branch ran.
NemoClaw is NVIDIA's open source reference stack for running agents such as OpenClaw inside its OpenShell sandboxes, with Ollama as one supported local inference backend [2]. Its Ollama handling is not uniform. Non-WSL hosts get 127.0.0.1:11434 behind a token-gated reverse proxy on 0.0.0.0:11435, and onboarding restarts a daemon bound elsewhere back to loopback [6]. The Windows-host path is the one that sets OLLAMA_HOST=0.0.0.0:11434 so Docker Desktop containers can reach the daemon, with no authentication in front of it [8]. The question an operator has to answer is therefore not whether they run NemoClaw but which of those arrangements their install picked, and that is a question about a systemd unit and a Docker Desktop setting rather than a version string.
The project has moved on this already, in a way that shows the seam. Since v0.0.106 on August 10, the local Ollama proxy refuses to start against a backend that is not bound to loopback, exiting with a dedicated status code and telling the operator to put OLLAMA_HOST=127.0.0.1 on the Ollama systemd unit [21][22]. Fifteen days later that was still the default in the tree The Hacker News read [26]. But the guard is a property of the proxy, and the Docker Desktop on WSL path skips the proxy entirely, because the container reaches the host's loopback through host.docker.internal [7]. A check that lives in the component the exposed path does not run is not a mitigation for that path [27]. There is also an override, NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1, for anyone who wants the older behaviour back [23].
The write lands below the API surface, which is why it sticks. The agent still supplies its own system prompt, and according to the report the planted instructions survive that and carry into later conversations [17]. Nothing in the agent changed, so restarting it or tightening its prompt leaves the stored template exactly where the attacker put it [25].
What to watch
- A CVE identifier and affected version range from NVIDIA PSIRT, without which scoping stays a per-host inspection job.
- Whether the Windows-host path drops the 0.0.0.0:11434 bind or gets the token gate the non-WSL proxy already has.
- Which browsers and operating systems the rebinding chain was actually verified against, since the report does not say.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence52
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Oasis Security disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself.
- [2]
NemoClaw is NVIDIA's open source reference stack for running agents such as OpenClaw inside its OpenShell sandboxes, and Ollama is one of its supported local inference backends.
- [3]
The Oasis Security report describes NemoClaw starting Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the model server to every network interface.
- [4]
Oasis Security said in the report: "Sandboxing protects the endpoint, but taking over the agent takes over its access and tools."
- [5]
NVIDIA's own Ollama setup documentation and the current source place that 0.0.0.0:11434 binding on one platform path, and NemoClaw's Ollama handling differs by platform.
- [6]
Non-WSL hosts keep Ollama on 127.0.0.1:11434 behind a token-gated reverse proxy on 0.0.0.0:11435, and onboarding restarts a daemon already bound elsewhere back to loopback.
- [7]
Docker Desktop on WSL skips the proxy, because the container reaches the host's loopback address through host.docker.internal.
- [8]
The Windows-host Ollama path sets OLLAMA_HOST=0.0.0.0:11434 so Docker Desktop containers can reach the daemon, and does not require authentication on port 11434.
- [9]
Ollama's own NemoClaw integration page advises setting OLLAMA_HOST=0.0.0.0 when running inside WSL2 or a container, and binding to 0.0.0.0 has previously been identified as the change that exposes Ollama instances beyond the local machine.
- [10]
The API on port 11434 has no authentication and relies on two middleware layers to block browser-originated requests; when the bind address is not loopback, the Host header check is skipped entirely.
- [11]
The CORS layer then treats the request as same-origin and allows it, because the Origin and Host headers both carry the attacker's own domain, which holds for a page the attacker serves on port 11434.
- [12]
DNS rebinding closes the gap, with the attacker's domain resolving first to their own server and then to 127.0.0.1 while the browser continues to treat the requests as same-origin.
- [13]
The report does not state which browsers or operating systems the chain was verified against.
- [14]
Verifying Host and Origin headers is the standard fix for that class of attack.
- [15]
DNS rebinding against Ollama's API is documented: Ollama shipped a fix in v0.1.29 on March 14, 2024, NCC Group published the advisory as CVE-2024-28224 the following month, and that advisory recommended validating the Host header on the server side to allow only a set of authorized values.
- [16]
The report's payload writes a modified Go template through /api/create; the template controls how the structured messages array is rendered into raw text before the model processes it, and the poisoned version appends attacker-controlled text to every system message at inference time.
- [17]
Instructions planted this way persist across later conversations and survive the agent supplying its own system prompt, according to the report.
- [18]
Oasis Security said: "The client cannot detect or prevent this - the template is a model-level property invisible to API consumers."
- [19]
The findings were shared with The Hacker News ahead of publication, and the report says Oasis Security reported them to NVIDIA's Product Security Incident Response Team beforehand.
- [20]
No exploitation has been reported as of August 25, 2026.
- [21]
The Hacker News reviewed the NemoClaw repository at commit 17f0ca3b on August 25 and found that the local Ollama proxy refuses to start against a backend that is not bound to loopback, a default introduced in v0.0.106 on August 10.
- [22]
The proxy exits with a dedicated status code and prints a refusal saying an Ollama daemon reachable on a non-loopback interface bypasses the proxy's token check entirely, and telling the operator to set OLLAMA_HOST=127.0.0.1 on the Ollama systemd unit.
- [23]
That bind check can be switched off by setting NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1.
- [24]
About 29 months separate Ollama's v0.1.29 rebinding fix on March 14, 2024 and this disclosure being current as of August 25, 2026.
- [25]
Because the poisoned template is stored as a model-level property rather than in the agent, actions taken on the agent, including restarts and stricter system prompts, leave it in place.
- [26]
The loopback bind probe had been the default for 15 days when The Hacker News read the repository.
- [27]
The bind probe is implemented in the local Ollama proxy, so it cannot fire on the Docker Desktop on WSL path, which skips the proxy altogether.
- [28]
The findings carry no CVE identifier, no affected version range and no patched version, so an operator running NemoClaw cannot currently check whether their installation is in scope.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comNvidia NemoClaw vulnerability allows full control of AI agent's local model server
1 article · August 26, 2026
- thehackernews.comA Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
1 article · August 25, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Agent SecurityFollow
- Chat template poisoningFollow
- DNS Rebinding AttacksFollow
- Local LLM InferenceFollow