NVIDIA NemoClaw Vulnerability Exposes AI Models to Unauthenticated Poisoning
Oasis Security researchers have disclosed a significant weakness in NVIDIA NemoClaw, an open-source reference stack for running AI agents, that could allow an attacker-controlled webpage to gain unauthenticated control over a local Ollama instance. This compromise facilitates the planting of hidden, persistent instructions directly within the AI model’s chat template, influencing subsequent inference outputs without client detection. The findings, shared with The Hacker News ahead of publication, underscore a critical gap in how local AI inference backends are secured.
Technical Details: Unauthenticated Ollama Control via DNS Rebinding
The core of the vulnerability lies in how NemoClaw configures its local Ollama instance. Specifically, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, causing the model server to bind to every network interface. While this facilitates broader access, it also bypasses crucial security mechanisms designed to protect the unauthenticated Ollama API, which normally relies on middleware to block browser-originated requests.
Attackers can leverage a combination of DNS rebinding and a misconfigured Cross-Origin Resource Sharing (CORS) layer to exploit this setup. In a typical scenario, an attacker’s domain first resolves to their own server. A malicious webpage served by the attacker then initiates requests. During this process, DNS rebinding causes the attacker’s domain to subsequently resolve to 127.0.0.1 (localhost), allowing the browser to direct requests to the local Ollama API. Crucially, because the Host and Origin headers both carry the attacker’s domain, the CORS layer treats the request as same-origin, granting access. This entire chain allows an attacker to interact with the exposed Ollama API.
Once the API is reachable, an attacker can utilize the /api/create endpoint to write a modified Go template. This template dictates how structured message arrays are rendered into raw text before the AI model processes them. By injecting attacker-controlled text, such as malicious instructions, into this template, the adversary can ensure these instructions are appended to every system message during inference. Oasis Security notes that these planted instructions persist across conversations and are invisible to API consumers, making detection and prevention by the client extremely difficult.
Addressing the NVIDIA NemoClaw Unauthenticated Ollama Control
This isn’t the first time Ollama’s API exposure has been a concern. Ollama previously addressed a similar DNS rebinding vulnerability, identified as CVE-2024-28224, in version 0.1.29 (March 2024). That fix introduced server-side Host header validation. However, as Oasis Security research head Elad Luz pointed out, Ollama skips this validation when bound to a non-loopback address like 0.0.0.0, precisely the configuration NemoClaw uses.
NVIDIA’s Product Security Incident Response Team (PSIRT) was informed of these findings. NemoClaw v0.0.35 introduced a fix for macOS and Linux, specifically by refusing to start the local Ollama proxy against a backend not bound to loopback. This default was added in v0.0.106. However, this fix does not extend to the Windows and WSL paths, where the 0.0.0.0 binding remains a default configuration. NVIDIA’s documentation advises operators on the Windows-host path not to expose port 11434 to a LAN or the internet, but this guidance primarily addresses external network access, whereas the DNS rebinding chain operates from the local browser.
Actionable Recommendations and Mitigations
To effectively mitigate poisoned chat templates in NemoClaw and prevent unauthenticated control of local AI models, security professionals should prioritize the following actions:
- Update NemoClaw (macOS/Linux): Users on macOS and Linux systems should immediately upgrade their NemoClaw installations to version 0.0.35 or later to benefit from the implemented proxy check that prevents non-loopback bindings.
- Manual Configuration for Windows/WSL: For deployments on Windows and Windows Subsystem for Linux (WSL), where the automatic fix is not present, manually configure the Ollama instance to bind exclusively to the loopback address (
127.0.0.1). This ensures the API is only accessible from the local host. - Avoid Overriding Proxy Checks: The
NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1environment variable can bypass the new security check in NemoClaw v0.0.106. This override is explicitly not recommended and should be avoided. - Network Segmentation: While the attack doesn’t strictly require network exposure, adhering to NVIDIA’s guidance to not expose port 11434 to the broader network or internet for any Ollama instance is still a sound security practice for defense-in-depth.
Understanding and implementing these preventative measures is crucial for safeguarding AI models from sophisticated client-side attacks that leverage inherent configuration weaknesses.
Related: Emerging Attack Vectors in AI Harnesses: Trust Boundary Exploitation, GitLab GraphQL Flaw CVE-2026-19478: Unauthenticated Project Deletion