CVE-2026-65105

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw versions 0.0.0 through 0.0.25

Description NVIDIA NemoClaw for Linux contains a flaw in its inference server setup that allows a remote attacker to access the inference service without authentication. In affected configurations, the software launches Ollama using the OLLAMA HOST variable set to 0.0.0.0:11434, causing the service to listen on all network interfaces and disabling Host-header validation.

An attacker can exploit this by inducing a victim to visit a malicious website and using DNS rebinding—a technique where a domain name is manipulated to resolve to a local IP address—to bypass browser security controls and communicate with the local Ollama API. This allows the attacker to perform unauthorized actions such as enumerating, downloading, or deleting models, and consuming GPU resources.

The most critical impact is persistent model poisoning via the /api/create endpoint. An attacker can modify the model's Go chat template, which controls how prompts are rendered. By inserting hidden instructions into this template, the attacker can manipulate the AI agent's behavior across future conversations, even if the session is restarted or a new system prompt is provided. Depending on the agent's permissions, this could lead to the generation of insecure code, suppression of security warnings, or disclosure of sensitive information accessible to the agent.

Recommendations Update NVIDIA NemoClaw to version 0.0.35. Bind Ollama to the loopback interface instead of 0.0.0.0 unless container access is strictly required. Restrict network access to port 11434 using a host firewall. Compare installed model templates against a known-good configuration using a /api/show dump to detect poisoning. Limit the permissions granted to AI agents, specifically restricting access to production SCM, CI, or MCP systems until the inference endpoint is secured.