A malicious webpage could reach the local model server behind a vulnerable NVIDIA NemoClaw deployment and alter the model used by an AI agent.
NVIDIA patched the flaw, tracked as CVE-2026-65105, on Aug. 25. The company rates it High severity with a CVSS score of 8.1 and says NemoClaw for Linux versions 0 through 0.0.25 is affected. Successful exploitation may lead to information disclosure or denial of service.
NemoClaw can run OpenClaw agents inside OpenShell sandboxes while using Ollama for local inference. The weakness reaches the inference layer beneath those controls, adding to concerns raised by recent OpenClaw vulnerabilities involving agent infrastructure, privileges, and sandbox boundaries.
How the NemoClaw flaw exposes local inference
In its security bulletin for CVE-2026-65105, NVIDIA classifies the flaw as CWE-306, Missing Authentication for Critical Function. Its CVSS vector specifies low attack complexity, no privileges required, no user interaction, and an adjacent-network attack vector.
In the configuration examined by Oasis Security, NemoClaw launched Ollama with OLLAMA_HOST=0.0.0.0:11434, exposing the service on all network interfaces rather than limiting it to loopback. Because the Ollama API does not require authentication, systems able to reach the service could interact with it directly.
Oasis researchers demonstrated a DNS-rebinding attack that allowed browser JavaScript to reach Ollama under the vulnerable configuration. They then used the /api/create endpoint to alter the model’s chat template, which controls how messages are formatted before inference.
The inserted instructions persisted across later conversations and remained active even when the agent supplied another system prompt. In the proof of concept, researchers repeated a query after poisoning the underlying model and received a response containing an injected marker without directly modifying the sandboxed agent.
Similar isolation problems have surfaced elsewhere in AI development tooling. Researchers at Black Hat 2026 disclosed critical flaws in AI coding agents that could expose credentials and development environments through untrusted inputs.
NVIDIA patches the flaw as teams tighten controls
NVIDIA lists versions 0 through 0.0.25 as affected and identifies commit f06796ff3, associated with version 0.0.25, as containing the security update. Because 0.0.25 appears in both the affected and updated fields, administrators should verify that deployed code contains the fixing commit rather than relying on the version number alone.
Organizations can further reduce exposure around local inference services:
- Update affected deployments and verify the fix. Confirm deployed NemoClaw code contains NVIDIA’s remediating commit.
- Restrict Ollama to loopback access. Keep the backend on
127.0.0.1unless broader access is explicitly required. - Require authenticated remote access. Place an authenticated proxy and firewall controls in front of inference services.
- Monitor configuration and runtime drift. Watch listening interfaces, model templates, settings, and sensitive API activity for unexpected changes.
- Apply least privilege to AI agents. Limit repositories, CI/CD systems, APIs, cloud resources, and credentials they can reach; formal agentic AI governance can define and enforce those boundaries.
- Baseline model configuration. Maintain known-good templates and settings to detect tampering and support recovery.
- Test incident response plans. Exercise model-poisoning and exposed-inference scenarios, including isolation, integrity checks, credential rotation, and restoration.
CVE-2026-65105 shows why inference servers and model configuration require the same authentication, segmentation, monitoring, and incident response controls applied to other privileged production infrastructure.
Read more: Attackers are also exploring indirect prompt injection techniques that hide malicious instructions in webpages, documents, and other content processed by AI agents.