A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
Oasis Security found NVIDIA NemoClaw's Ollama binding to 0.0.0.0 enables DNS rebinding attacks that let attacker pages poison model chat templates with persistent hidden instructions.
Oasis Security disclosed that NVIDIA NemoClaw on Windows/WSL paths binds Ollama to 0.0.0.0:11434 without authentication, exposing the API to browser-based DNS rebinding attacks from malicious webpages. An attacker can then modify the model's chat template via /api/create, planting hidden instructions that run on every subsequent inference and persist across conversations, invisible to API consumers. NemoClaw v0.0.35 fixed the issue on macOS and Linux; no fix exists for Windows and WSL paths beyond a warning in v0.0.34. Ollama's own 2024 fix (CVE-2024-28224) added Host header validation, but it is skipped when bound to non-loopback addresses. No exploitation has been reported as of August 25, 2026.
- NemoClaw Windows/WSL binds Ollama to 0.0.0.0 without auth, bypassing Host validation
- DNS rebinding lets attacker webpage reach localhost API as same-origin request
- Chat template poisoning injects attacker instructions into every future conversation invisibly
- Fixed on macOS/Linux in v0.0.35; Windows/WSL path lacks full remediation
- No CVE assigned; no exploitation observed as of publication
- CVEs
- CVE-2024-28224
- Vendors
- NVIDIAOasis SecurityOllama
- Organizations
- NCC Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-28224 | Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat… | 6.6 | <1% |
From the original article
4 min read at thehackernews.com
Oasis Security has disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take unauthenticated control of the local Ollama instance serving an AI agent and plant hidden instructions inside the model itself.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.