NVIDIA and Ollama: NVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS Rebinding

Critical NVIDIA NemoClaw Vulnerability Exposes AI Agents to Persistent Hijacking

Researchers from Oasis Security have uncovered a severe vulnerability in NVIDIA NemoClaw (CVE-2026-65105) that could allow attackers to seize persistent control of locally deployed AI agents with minimal user interaction. The flaw stems from an unauthenticated API exposure in NemoClaw’s integration with Ollama, a local inference backend, enabling exploitation via DNS rebinding attacks.

How the Attack Works

NemoClaw deploys the OpenClaw AI agent within NVIDIA’s OpenShell sandboxes, using Ollama to run models on local hardware. However, NemoClaw configures Ollama to bind to 0.0.0.0:11434, exposing the service to the local network rather than restricting it to 127.0.0.1. While Ollama’s API lacks authentication, it relies on CORS and Host-header validation to block unauthorized access except when bound to 0.0.0.0, where Host-header checks are bypassed.

Attackers can exploit this via DNS rebinding, a technique where a malicious domain initially resolves to an attacker-controlled server before switching to 127.0.0.1 or another local IP. When a victim visits the attacker’s site, their browser trusting the same-origin policy sends requests to the local Ollama API, granting full access without authentication.

Exploitation Risks

Once compromised, attackers can:

• Enumerate installed AI models and extract version details.
• Consume GPU resources or download large models to exhaust disk space.
• Delete or replace models with malicious versions.
• Poison model templates via Ollama’s /api/create endpoint, embedding hidden instructions that persist across all future interactions.

Unlike temporary system prompts, template poisoning alters how the AI processes every input, allowing attackers to:

• Generate backdoored code or suppress security warnings.
• Recommend malicious packages/URLs in responses.
• Exfiltrate conversation data or files if the agent has outbound access.

Broader Impact

While OpenShell sandboxing limits direct host-level risks, the vulnerability introduces two key threats:

1. Local Network Exposure: Any device on the same network can access Ollama without DNS rebinding.
2. Persistent AI Compromise: Poisoned models retain their original appearance (name, metadata, size) while executing attacker-controlled instructions in the background.

Disclosure & Response

The researchers reported the issue to NVIDIA’s Product Security Incident Response Team before public disclosure. Organizations using NemoClaw with local Ollama inference are advised to restrict access to port 11434 and audit model templates for unauthorized modifications.

Source: https://gbhackers.com/nvidia-nemoclaw-vulnerability/

NVIDIA TPRM report: https://www.rankiteo.com/company/nvidia

Ollama TPRM report: https://www.rankiteo.com/company/ollama

"id": "ollnvi1787739914",
"linkid": "ollama, nvidia",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Organizations using NVIDIA '
                                              'NemoClaw with local Ollama '
                                              'inference',
                        'industry': 'Semiconductors, AI, Computing',
                        'location': 'Global',
                        'name': 'NVIDIA',
                        'size': 'Large Enterprise',
                        'type': 'Technology Company'}],
 'attack_vector': 'DNS Rebinding Attack',
 'customer_advisories': 'Organizations using NVIDIA NemoClaw with local Ollama '
                        'inference are advised to restrict access to port '
                        '11434 and audit model templates for unauthorized '
                        'modifications.',
 'data_breach': {'data_exfiltration': 'Possible if agent has outbound access',
                 'sensitivity_of_data': 'High (persistent AI agent control, '
                                        'potential data exfiltration)',
                 'type_of_data_compromised': 'AI model templates, conversation '
                                             'data, files'},
 'description': 'Researchers from Oasis Security have uncovered a severe '
                'vulnerability in NVIDIA NemoClaw (CVE-2026-65105) that could '
                'allow attackers to seize persistent control of locally '
                'deployed AI agents with minimal user interaction. The flaw '
                'stems from an unauthenticated API exposure in NemoClaw’s '
                'integration with Ollama, a local inference backend, enabling '
                'exploitation via DNS rebinding attacks. Attackers can '
                'enumerate models, consume GPU resources, delete or replace '
                'models, and poison model templates to embed hidden '
                'instructions that persist across all future interactions.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'AI agent compromise',
            'data_compromised': 'AI model templates, conversation data, files '
                                '(if outbound access exists)',
            'operational_impact': 'GPU resource exhaustion, disk space '
                                  'exhaustion, persistent AI agent hijacking',
            'systems_affected': 'NVIDIA NemoClaw with Ollama integration'},
 'post_incident_analysis': {'corrective_actions': 'Restrict Ollama API access '
                                                  'to 127.0.0.1, implement '
                                                  'authentication for Ollama '
                                                  'API, and enforce '
                                                  'Host-header validation',
                            'root_causes': 'Unauthenticated API exposure in '
                                           'NemoClaw’s integration with '
                                           'Ollama, misconfiguration of Ollama '
                                           'binding to 0.0.0.0, and lack of '
                                           'Host-header validation when bound '
                                           'to 0.0.0.0'},
 'recommendations': 'Restrict access to port 11434, audit model templates for '
                    'unauthorized modifications, and review local AI agent '
                    'deployments for similar vulnerabilities.',
 'references': [{'source': 'Oasis Security Research'}],
 'response': {'containment_measures': 'Restrict access to port 11434, audit '
                                      'model templates for unauthorized '
                                      'modifications'},
 'title': 'Critical NVIDIA NemoClaw Vulnerability Exposes AI Agents to '
          'Persistent Hijacking',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-65105 (Unauthenticated API exposure in '
                            'NVIDIA NemoClaw)'}