CVE-2026-65105: How a Single Web Page Can Poison NVIDIA NemoClaw’s Local Model

Last updated: 26 August 2026. Figures, version numbers and quotes in this piece are sourced to the primary publications linked inline — the CVE record, NVIDIA’s own release notes, and the researchers’ technical write-up. Where a number comes from the vendor’s own assessment rather than an independent one, we say so.

The 60-second version

• On 25 August 2026, researchers at Oasis Security — which Cyera agreed in July 2026 to acquire, and on whose site the write-up is hosted — disclosed a flaw in NVIDIA NemoClaw, the company’s reference stack for running agents such as OpenClaw inside a sandbox on a developer’s own machine.
• NemoClaw starts the local Ollama inference server bound to 0.0.0.0:11434 so that containers can reach it. Ollama skips Host-header validation when it binds to a non-loopback address, which reopens the door to DNS rebinding from an ordinary web page.
• The payoff is not a one-off prompt injection. The attacker calls /api/create to rewrite the model’s chat template — the Go template applied to every message at inference time — so attacker text is appended to every system message, in every future conversation, until someone notices.
• It is tracked as CVE-2026-65105, scored 8.1 (High) by NVIDIA, and described in the CVE record as affecting NemoClaw for Linux, versions 0 through 0.0.25.
• That description is narrower than what the researchers demonstrated, and the gap between the two is the most interesting thing about this disclosure.

Key numbers and dates

What actually happened

NemoClaw is NVIDIA’s answer to a real problem: people want to run autonomous coding agents on their own hardware, and doing so on a bare laptop is reckless. Announced at GTC in March 2026, it wraps agents such as OpenClaw in a sandboxed OpenShell environment and supports a local Ollama backend, so the agent can think without calling a cloud API. It is marketed, in other words, as the responsible way to do this.

To make the sandbox work, the containerised agent must reach the inference server on the host. The straightforward way to arrange that is to bind Ollama to every interface — OLLAMA_HOST=0.0.0.0:11434 — rather than to loopback. Ollama has a Host-header check designed to stop browsers reaching it, but that check is skipped entirely when the server binds to a non-loopback address. From there the attack is a textbook DNS rebind: the victim loads an attacker’s page, the attacker’s domain re-resolves to 127.0.0.1, and the browser treats requests to the local inference server as same-origin. Elad Luz and Ofek Itach, who published the research, put the requirement plainly: “A single visit to an attacker-controlled webpage is all it takes to give the attacker these capabilities.” No credentials, no downloads, no interaction beyond loading a page.

The chat template is the part worth understanding

Most write-ups of this have led on DNS rebinding, which is the least novel element — NCC Group published essentially the same attack against Ollama in April 2024, and it was fixed in Ollama 0.1.29. The genuinely new part is what the attacker does once inside.

An attacker with access to the Ollama API could simply send prompts. That is noisy and largely useless against an agent, because the agent supplies its own system prompt on every call and overrides whatever came before. So instead the researchers went one level down. The /api/create endpoint lets you define a model — including its chat template, the Go template Ollama applies to render messages before inference. Rewrite that template to append attacker-controlled text to every system message, and the injection is no longer something the client sends. It is a property of the model itself.

Why that breaks the usual defences

Nearly every practical mitigation in our guide to handling prompt injection and LLM security assumes the attack arrives through content the model reads: a web page it fetches, a document it summarises, a tool result it ingests. Input sanitisation, delimiter discipline, provenance tagging and output filtering all operate on that pipeline. None of them see a poisoned template, because the poisoning happens after the client hands its messages over and before the model sees them. The API consumer has no way to inspect it and no reason to look.

It also survives everything a user would instinctively try. Starting a new conversation, clearing history and restarting the agent all leave it in place: the template is stored with the model, so the compromise persists until the model is re-pulled or the tampered definition removed.

The consequences the researchers list are the ones you would expect from a compromised coding agent: running arbitrary inference on the victim’s hardware, enumerating models and extracting system prompts and templates, exfiltrating the machine’s hostname and Ollama public key, deleting models, forcing sign-out, filling the disk by pulling large models — and, the serious ones, supplying backdoor-generated code and inserting vulnerabilities, suppressing security warnings, steering recommendations toward attacker-controlled packages, URLs or configurations, and exfiltrating data where the agent has outbound network access. Randolph Barr, chief information security officer at Cequence Security, told Dark Reading that pointing an agent “at an unauthenticated local model server is the new part, and it’s a good preview of where agentic AI risk actually lives.”

What the CVE record understates

Here is where the public record and the research diverge, and it matters for anyone triaging this from a vulnerability feed.

The CVE record, assigned and scored by NVIDIA itself, describes the issue as affecting “NVIDIA NemoClaw for Linux” in versions 0 through 0.0.25, and scores it AV:A — adjacent network. That vector implies an attacker who is already on your local network segment. But the demonstrated attack does not require that at all. It requires a browser tab. A drive-by from the open internet is an AV:N attack in everything but the letter of the specification, and rating it as adjacent will cause some teams to deprioritise it below where it belongs.

The version scope is muddier still. NVIDIA’s record caps the affected range at 0.0.25. Reporting from Dark Reading says Oasis confirmed to it that the bug is fixed for macOS and Linux in v0.0.35, but that there is no fix for Windows — v0.0.34 ships a Windows installation carrying a warning instead. The Hacker News adds that v0.0.106, released 10 August, introduced a proxy check that refuses to start against a non-loopback Ollama backend. None of these accounts lines up cleanly with the version range in the CVE record. NemoClaw is now on v0.0.114, released 23 August 2026, whose notes mention recovery logic that distinguishes “bind refusals for Ollama, unauthenticated compatible endpoints, and backends whose type is unavailable” — consistent with hardening, but not an advisory, and not a statement that the Windows path is closed.

None of that is scandalous — it is the ordinary friction of a fast-moving stack where release notes, CVE records and researcher timelines are written by different people for different audiences. But it means “we’re on a recent version” is not, on its own, an answer.

The broader pattern is familiar from our earlier piece on OpenAI pausing its largest training run over cyber risk last week. That story was about frontier labs worrying whether a model is too capable at offence. This one is the unglamorous other half of the same problem: the offensive capability that mattered here was a 2024-vintage DNS rebind against a service someone left listening on all interfaces for perfectly sensible plumbing reasons.

Practical takeaways for people who build, publish or run software

• Treat every local inference port as internet-reachable. Port 11434 on a developer laptop is not “internal” in any meaningful sense: any web page the developer opens can attempt to reach it. Bind to loopback and give containers an explicit proxy or socket, rather than binding wide and relying on a header check.
• Add model definitions to your integrity checks. Most teams pin weights by digest and stop there. Chat templates, system-prompt defaults and modelfile parameters are mutable configuration that changes behaviour and is not covered by a weights hash. Record them, and diff them. If an agent is behaving oddly, inspect its template before you assume the problem is your prompt.
• Sandboxing the agent is not the same as trusting the model. NemoClaw’s OpenShell sandbox was doing its job — the trust boundary that failed was the inference backend it called out to. If your threat model stops at the filesystem, it stops too early.
• Assume agent output is attacker-influenced when reviewing it. A poisoned agent’s most valuable action is not exfiltration; it is writing code you merge. The review discipline in our playbook on maintaining human oversight in AI-heavy workflows is the control that actually catches this, and it only works if the human reviewer is genuinely reading the diff.
• Revisit what your agents can reach. The impacts the researchers demonstrated run from GPU abuse to backdoored code and data exfiltration, because that is the reach a coding agent is handed. The scoping questions in our guide to using AI tools safely with client and company data apply with more force to an agent than to a chatbot, because an agent acts on what it concludes.

What we still don’t know

• Whether the Windows and WSL paths are fixed. The CVE record scopes the issue to Linux. Oasis told Dark Reading on 25 August that there was no fix for Windows, while Elad Luz told Security Boulevard the same week that the vulnerability “has been remediated in the latest update to NemoClaw” without naming a version. Those two statements sit awkwardly together. We could not retrieve NVIDIA’s own security bulletin — the vendor’s advisory pages are blocked by robots.txt and cannot be fetched automatically — so we cannot confirm the current Windows status from a primary vendor document.
• The real affected version range. The CVE says 0 through 0.0.25. Oasis, via Dark Reading, attributes the macOS and Linux fix to v0.0.35. The Hacker News points to v0.0.106 adding a proxy check against non-loopback Ollama backends. We have not found a primary NVIDIA document that reconciles these.
• Whether this was ever exploited in the wild. No exploitation has been reported. That is not the same as evidence of none, and template poisoning is close to invisible: there is no crash, no obvious network signature, and no artefact a user would stumble across.
• How many installs are exposed. No figure has been published for NemoClaw deployments, let alone how many sit on affected versions.
• Whether other agent stacks share the pattern. NemoClaw is the one that got looked at. The design pressure that produced the wide bind — a containerised agent needing to reach a host service — exists across self-hosted agent tooling, and the systematic red-teaming described in our guide to stress-testing AI systems has not publicly been run across this category.
• NVIDIA’s own account. The company did not immediately respond to Dark Reading’s request for comment, and its own advisory pages could not be retrieved for this piece.

FAQ

Am I affected if I use OpenClaw but not NemoClaw?

The flaw is in how NemoClaw configures Ollama, not in OpenClaw itself. But the underlying condition — an Ollama server bound to a non-loopback address without authentication — can be created by any setup, hand-rolled ones included. Check what your OLLAMA_HOST is set to.

Will restarting my agent or clearing chat history remove the poisoning?

No. The injected text lives in the model’s chat template, which is stored with the model. It applies to every new conversation until the model is removed and re-pulled, or the tampered definition is deleted.

Is a CVSS score of 8.1 the right severity?

That score is NVIDIA’s own assessment. The confidentiality and availability impacts are rated High and integrity None, which sits oddly with an attack whose entire point is rewriting model behaviour, and the “adjacent network” attack vector arguably understates a drive-by that works from any web page. Treat 8.1 as a floor rather than a ceiling.

What should I do right now?

Update NemoClaw to the current release, confirm Ollama is bound to 127.0.0.1 rather than 0.0.0.0, block external access to port 11434, and list your local models and inspect their templates for anything you did not put there.

Sources

Primary sources first.

• CVE-2026-65105 record — description, CVSS v3.1 score and vector, CWE class, affected version range, reserved and published dates.
• Oasis Security / Cyera, “Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning” — the original technical research by Elad Luz and Ofek Itach.
• NVIDIA NemoClaw release notes, v0.0.114, 23 August 2026.
• NVIDIA NemoClaw release notes, v0.0.105, 7 August 2026.
• NCC Group technical advisory, Ollama DNS rebinding (CVE-2024-28224), April 2024 — the precedent.
• Dark Reading, “Finding Nemo(Claw): Issue Allows for LLM Poisoning in OpenClaw”.
• SiliconANGLE on the disclosure, and The Hacker News.
• Security Boulevard — remediation comment from Elad Luz.

Please follow and like us: