NVIDIA NemoClaw Flaw Allows Remote LLM Poisoning via DNS Rebinding
A networking misconfiguration in the NemoClaw deployment tool enables attackers to permanently alter AI agent behavior through a single malicious webpage visit.
A critical networking vulnerability in NVIDIA's NemoClaw tool allows remote attackers to gain unauthenticated control over local model servers, potentially poisoning the behavior of AI agents. The flaw enables an attacker to permanently alter an agent's core instructions simply by tricking a user into visiting a malicious webpage.
Researchers from Cyera's Oasis Identity Research discovered that NemoClaw incorrectly configures the Ollama API to listen on 0.0.0.0:11434 rather than the secure 127.0.0.1 loopback address. Furthermore, the tool disables the Ollama Host-header check when bound to a non-loopback address. By leveraging DNS rebinding, an attacker can bypass browser security boundaries to interact with the local server. Once access is gained, the attacker can use the /api/create endpoint to modify the LLM's chat template. This modification persists across all future conversations and remains invisible to both the end user and the AI agent, as confirmed by the vulnerability tracked as CVE-2026-65105.
The Infrastructure Gap
NemoClaw serves as a deployment tool for the OpenClaw AI agent framework, which is designed to run autonomous agents within NVIDIA OpenShell sandboxes. To handle inference, it relies on Ollama as the local runtime. While sandboxing is intended to isolate the agent's actions from the host system, this vulnerability exposes a fundamental weakness in the underlying infrastructure. As Randolph Barr, CISO at Cequence Security, noted, sandboxing an agent provides little protection if the foundation it is built upon is reachable from any open browser tab.
Implications for Agentic AI
This flaw highlights a burgeoning category of "agentic AI risk," where the vulnerability is not in the model's weights, but in the deployment pipeline. Because AI agents in the OpenClaw framework are often granted authorized access to sensitive corporate APIs, internal codebases, and private resources, a poisoned agent becomes a persistent, invisible backdoor.
If an attacker can dictate the agent's behavior through a corrupted chat template, they can effectively command the agent to exfiltrate data or compromise systems using the agent's own legitimate credentials. Rickard Carlsson, CEO of Detectify, warned that controlling an agent's behavior can be equivalent to having full access to the machine itself.
Current Status
NVIDIA has been notified of the vulnerability, and the core mechanism of the exploit has been verified by independent security researchers. While the technical path to exploitation—combining the 0.0.0.0 binding and the disabled Host-header check—is well-documented, users are encouraged to audit their local Ollama configurations and restrict API access to the loopback interface to mitigate the risk of DNS rebinding attacks.