"Sandboxing protects the endpoint, but taking over the agent takes over its access and tools," Oasis Security said in the report.
How NemoClaw, Ollama, and platform paths place the model server on the network
NemoClaw is NVIDIA's open source reference stack for running agents such as OpenClaw inside OpenShell sandboxes, and Ollama is one of its supported local inference backends. Oasis Security's report describes NemoClaw starting Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the model server to every network interface. That configuration makes the Ollama API reachable from outside the loopback address on affected platform paths.
The NemoClaw codebase and NVIDIA documentation show three differing platform behaviors: on non-WSL hosts, Ollama runs on 127.0.0.1:11434 behind a token-gated reverse proxy bound on 0.0.0.0:11435 and onboarding restarts a daemon already bound to loopback; Docker Desktop on WSL skips the proxy because containers can reach the host loopback via host.docker.internal; and the Windows-host Ollama path sets OLLAMA_HOST=0.0.0.0:11434 so Docker Desktop containers can reach the daemon and does not require authentication on port 11434.
Ollama's own NemoClaw integration page also advises setting OLLAMA_HOST=0.0.0.0 when running inside WSL2 or a container. The report notes that binding Ollama to 0.0.0.0 has previously been identified as the change that exposes Ollama instances beyond the local machine.
DNS rebinding and skipped Host/Origin checks that let a webpage reach the API
The Ollama API on port 11434 has no built-in authentication and depends on two middleware layers to block browser-originated requests. When the daemon is bound to a non-loopback address, the server-side Host header check is skipped entirely. The Cross-Origin Resource Sharing (CORS) layer then treats the request as same-origin and allows it because the Origin and Host headers both carry the attacker's domain — a condition that can hold for a page the attacker serves on port 11434.
DNS rebinding closes the remaining gap: the attacker's domain resolves first to their server and then to 127.0.0.1 while the browser continues to treat subsequent requests as same-origin. The report does not specify which browsers or operating systems this chain was verified against; it notes only that verifying Host and Origin headers is the standard fix for this class of attack.
Ollama previously shipped a fix in v0.1.29 on March 14, 2024, and NCC Group published an advisory as CVE-2024-28224 the following month. That advisory recommended validating the Host header server-side to allow only a set of authorized values.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPoisoned chat templates: a persistent, model-level backdoor
With the API reachable, Oasis Security's proof-of-concept writes a modified Go template through /api/create. That template controls how the structured messages array is rendered into raw text before the model processes it. The poisoned template appends attacker-controlled text to every system message at inference time. According to the report, those instructions remain attached to the model: they persist across later conversations and survive the agent supplying its own system prompt.
"The client cannot detect or prevent this - the template is a model-level property invisible to API consumers," Oasis Security said. The Hacker News notes that poisoned chat templates have been documented previously; Oasis researchers used a comparable browser-to-localhost path against Paperclip earlier this month and hijacked local OpenClaw agents via a similar route in February.
NemoClaw's recent changes, remaining gaps, and the lack of an assigned CVE
The Hacker News reviewed the NemoClaw repository at commit 17f0ca3b on August 25 and found that a default introduced in v0.0.106 on August 10 makes the local Ollama proxy refuse to start against a backend that is not bound to loopback. The proxy exits with a dedicated status code and prints:
"Refusing to start: an Ollama daemon reachable on a non-loopback interface bypasses the proxy's token check entirely. Set OLLAMA_HOST=127.0.0.1:${{port}} on the Ollama systemd unit or set NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1 to override (not recommended)."
That bind check can be switched off with NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1, and it does not fail closed on hosts where the bind check cannot run. The check also runs inside the proxy itself, but NemoClaw does not start that proxy on the WSL paths — and the Windows-host configuration is one such path — so the v0.0.106 default does not reach the platform path where the 0.0.0.0 binding is set. The repository review also found no chat-template integrity check: NemoClaw queries Ollama's /api/show endpoint only for a model's native context length and declared tool-calling capability.
Oasis Security reported the findings to NVIDIA's Product Security Incident Response Team (PSIRT) beforehand and shared them with The Hacker News ahead of publication, but the disclosure carries no CVE identifier, no affected version range, and no patched version. No exploitation has been reported as of August 25, 2026.
What this means for technologists, operators, and end users
- Technologists and security teams: review OLLAMA_HOST bindings on deployed hosts and containers, avoid disabling the NemoClaw bind-probe flag, and look for absence of template integrity controls — the attack vector abuses an unauthenticated API plus template persistence. Expect to verify host and origin header validation wherever Ollama is reachable.
- Operators and procurement leads: the disclosure currently includes no CVE, no version range, and no patch, so you cannot rely on a single identifier or fixed release to determine exposure. NVIDIA's documentation already instructs Windows-host operators not to expose port 11434 to a LAN or the internet — but that guidance does not address the browser-running-on-host path used by DNS rebinding.
- End users: no exploitation has been reported as of August 25, 2026, but a malicious webpage running in a browser on the same host can, in the described chain, reach the local API and implant persistent instructions into a model's chat template.
Oasis Security's chain links a known web-based trick — DNS rebinding and skipped Host checks — with model-level persistence via chat templates. The Hacker News has reached out to Oasis Security for the NemoClaw version and platform path the proof of concept was verified against and will update this story with any response.
https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
