A simple web page was enough to poison the local model of an NVIDIA NemoClaw agent

The CVE-2026-65105 flaw, revealed by Oasis Security, combined an Ollama port open on all interfaces, an API without authentication and a DNS rebinding attack.

Researchers at Oasis Security, led by Elad Luz, published details of a critical vulnerability in NemoClaw, NVIDIA's tool for running agents with a locally executed model, on August 25. Referenced CVE-2026-65105, it allowed an attacker to take control of the model server from a simple visit to a booby-trapped web page.

Three flaws were added up. NemoClaw ran Ollama with the variable OLLAMA_HOST=0.0.0.0:11434, exposing the port on all network interfaces instead of restricting it to the local machine. Ollama's API doesn't provide any native authentication. Finally, a classic DNS rebinding — pointing a controlled domain to 127.0.0.1 after the initial page load — was enough to bypass the same-origin policy and the verification of the Host header.

The final load was through the endpoint's /api/create template field, where the attacker inserted persistent instructions applied to each message sent to the agent. In other words, a developer could continue to work with a seemingly normal wizard, while receiving code that had been deliberately added to it, or whose security issues were hidden. NVIDIA released a patch, the details of which can be found on its security portal; no real-world exploitation has been documented at this stage.