One Malicious Webpage Poisons the Local Model Behind an NVIDIA NemoClaw Agent (CVE-2026-65105)

NVIDIA NemoClaw, the vendor's packaged deployment wrapper for running OpenClaw agents against a local Ollama model server

Oasis Security, part of Cyera, disclosed a chain in which visiting an attacker-controlled web page is enough to take over the model behind a developer's local agent. NemoClaw launches Ollama with `OLLAMA_HOST=0.0.0.0:11434`, exposing the inference server unauthenticated on every interface and stepping around the token-gated reverse proxy that was supposed to front it. Ollama validates neither Host nor Origin headers, so a DNS rebinding attack that re-resolves an attacker domain to 127.0.0.1 lets a page in the victim's browser speak to that server while the browser still treats the request as same-origin. From there the attacker reads the model's existing chat template through `/api/show`, injects instructions into the Go text template that renders every message before inference, and re-uploads the poisoned model through `/api/create`. The result is persistent: the injected text is appended to every system message in every later conversation, it survives restarts, and, as Oasis put it, "the client cannot detect or prevent this, the template is a model-level property invisible to API consumers." Anything the agent is authorized to reach, source repositories, cloud accounts, internal services, is reachable through it. No exploitation has been reported. NVIDIA fixed macOS and Linux in v0.0.106; Windows and WSL received warnings rather than a fix

A deployment wrapper that broadened a local service's bind address for convenience, on top of an inference server with no authentication and no browser-origin checks, and a model format in which the prompt template is attacker-writable state rather than read-only configuration. Prompt injection normally lives in the conversation; here it lives in the model