NVIDIA NemoClaw Flaw CVE-2026-65105 Enables AI Agent Hijacking via Malicious Websites

A high-severity vulnerability in NVIDIA NemoClaw could allow attackers to gain unauthenticated access to a locally running Ollama inference server and potentially hijack AI agents after a victim visits a malicious website.

Tracked as CVE-2026-65105, the flaw affects NemoClaw’s inference-server setup and was disclosed by security researchers from Oasis Security, now part of Cyera. NVIDIA has assigned the vulnerability a CVSS v3.1 score of 8.1, classifying it as a High-severity issue involving missing authentication.

NemoClaw is NVIDIA’s framework for running the OpenClaw AI agent inside an OpenShell sandbox, while supporting Ollama for local model inference.

NVIDIA NemoClaw Flaw

This architecture allows developers to process prompts and code on local hardware rather than sending them to a cloud-based AI service. However, researchers found that the networking configuration used to connect the sandbox to Ollama creates a security exposure that can be combined with a browser-based DNS rebinding attack.

The underlying problem begins with how NemoClaw configures Ollama. Because OpenShell sandboxes operate inside Docker containers, a service bound only to the host’s loopback address cannot normally be reached from the container.

NemoClaw therefore starts Ollama using OLLAMA_HOST=0.0.0.0:11434, causing the inference server to listen on all network interfaces rather than only localhost.

Although NemoClaw may present the service as running on localhost:11434, the underlying socket can be reachable through other interfaces and by devices on the same network.

Ollama’s API does not require authentication and instead relies on security controls such as CORS and Host-header validation to restrict unauthorized browser access.

Researchers found that Host-header validation is skipped when Ollama is bound to a non-loopback address such as 0.0.0.0. This leaves CORS as the primary browser defense, which can then be bypassed through DNS rebinding.

In a DNS-rebinding attack, a malicious website initially resolves an attacker-controlled domain to the attacker’s infrastructure.

After the victim loads the page, the DNS response is changed so that the same hostname resolves to a local address such as 127.0.0.1.

Because browser same-origin protections are based on the hostname rather than the destination IP address, JavaScript running on the malicious page can subsequently communicate with the victim’s local Ollama API. This allows the attacker to reach a service that the victim may believe is accessible only locally.

Once access is obtained, the attacker can interact with Ollama’s API to enumerate installed models, retrieve model information and templates, consume GPU resources through inference, download additional models, delete models, and perform other administrative actions.

The most serious consequence, however, is persistent model-template poisoning. Researchers demonstrated that an attacker can modify a model’s chat template so that hidden instructions are inserted into future prompts processed by the model.

Unlike a simple system-prompt injection, template-level poisoning can persist even when OpenClaw supplies its own system instructions.

The malicious template can append attacker-controlled instructions to system messages while preserving the model’s normal formatting and behavior.

As a result, future interactions with the compromised model could cause an AI agent to suppress security warnings, recommend malicious packages, introduce vulnerable code, or potentially exfiltrate information through tools available to the agent.

The OpenShell sandbox provides meaningful isolation, but it does not eliminate the risk. AI agents commonly receive access to source-control systems, CI/CD pipelines, cloud services, internal APIs, communication platforms, and MCP-based tools.

Consequently, compromising the model that guides an agent could provide an attacker with indirect control over resources available through those integrations.

NVIDIA has released a security update addressing CVE-2026-65105. The affected NemoClaw versions are 0 through 0.0.25, with the issue addressed in updated NemoClaw releases including 0.0.25 and the corresponding fixed repository revision.

Organizations should update NemoClaw immediately, restrict access to TCP port 11434, avoid unnecessary network exposure of local inference services, monitor for unexpected model or template modifications, and review AI-agent activity for anomalous tool calls or outbound data transfers.