Threat reportVulnerabilityTL-2026-4428
NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama API and DNS Rebinding (CVE-2026-65105)
NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama (TL-2026-4428), also tracked as NemoClaw Drive-By Model Poisoning, is a high-severity software vulnerability scored CVSS 8.1, first published 2026-10-26. It has no confirmed attribution, affects NVIDIA NemoClaw (Linux, with Ollama inference backend), references 1 CVE (CVE-2026-65105), maps to 7 MITRE ATT&CK / ATLAS techniques (AML.T0051, T1005, T1082), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 8.1/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4428
- Threat ID
- TL-2026-4428
- Also known as
- NemoClaw Drive-By Model Poisoning, NemoClaw Chat Template Poisoning
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, ai-ml
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
Malware and tooling: NemoClaw, Ollama, OpenClaw
How NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama works
NVIDIA NemoClaw launches its Ollama inference backend with OLLAMA_HOST=0.0.0.0:11434, exposing an unauthenticated API and disabling Ollama's Host-header validation. A malicious webpage can use DNS rebinding to reach the API, rewrite a model's chat template via /api/create, and persistently inject hidden instructions into every inference call. Disclosed by Oasis Security on 2026-08-25; no in-the-wild exploitation was reported at disclosure.
CVE-2026-65105 (CWE-306, Missing Authentication for Critical Function) affects NVIDIA NemoClaw, an agent toolkit that runs a local Ollama model server for OpenClaw-style agents. To let containers reach the host-side inference service, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the API to every interface instead of loopback. Ollama's API performs no authentication, and for non-loopback bindings Ollama skips its Host-header validation, the check designed to stop browsers from reaching local services. Only CORS handling remains, and DNS rebinding defeats it because Origin and Host then match.
Exploit chain (per Oasis Security, as reported by NSFOCUS, CSA, Cyera, CSO Online and The Hacker News): (1) the victim visits an attacker-controlled or compromised webpage; (2) the attacker's domain first resolves to the attacker's server (short TTL), then re-resolves to 127.0.0.1, so browser JavaScript treats requests to port 11434 as same-origin; (3) the script enumerates the instance (GET /api/tags, GET /api/show) and retrieves the model's Go chat template; (4) it builds a tampered Go template that appends attacker-controlled hidden instructions to every system message and writes it back with POST /api/create. Because the template is a model-level property, it is invisible to API consumers, survives client-supplied system prompts, session resets and restarts, and leaves no anomaly in conversation logs. The agent cannot override it, so the agent's tool-calling capabilities effectively become attacker-steerable.
Other capabilities demonstrated or listed: enumerating installed models and the Ollama version, extracting model details and system prompts, deleting models (DELETE /api/delete), arbitrary inference (/api/generate, /api/chat), and pulling large models to exhaust disk (/api/pull). NVD describes the impact as unauthorized information access and service disruption. The technique builds on the older Ollama DNS-rebinding issue CVE-2024-28224 (fixed in Ollama v0.1.29, March 2024); NemoClaw's non-loopback bind re-opens that exposure. Similar poisoned chat-template techniques have been documented against other agents (Paperclip, OpenClaw).
Version and patch information in the sources is inconsistent. NVD and eSecurityPlanet list NemoClaw for Linux versions 0 through 0.0.25 as affected (fixed commit f06796ff3, with version 0.0.25 appearing on both sides). CSA and The Hacker News report v0.0.35 as the practical fix for macOS and Linux, and v0.0.106 (reported as 2026-08-10) as adding an enforced bind-address probe that refuses non-loopback backends. Windows/WSL paths were not structurally fixed at disclosure: v0.0.34 added only an installer warning. Defenders should test actual network reachability of port 11434 rather than trust version strings. Not reported: public PoC release, in-the-wild exploitation, attacker infrastructure or malware IOCs.
MITRE ATT&CK / ATLAS techniques used in TL-2026-4428
Execution
AML.T0051 LLM Prompt Injection
Collection
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1485 Data Destruction; T1496 Resource Hijacking; T1565 Data Manipulation
Affected products and versions in NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
- NVIDIA — NemoClaw (Linux, with Ollama inference backend)
Vulnerable versions: 0 through 0.0.25 (NVD); Windows/WSL path remained exposed through v0.0.34 at disclosure
Fixed in: Commit f06796ff3 (NVD); v0.0.35 (macOS/Linux practical fix per CSA/The Hacker News); v0.0.106 (enforced loopback bind-address probe) - Ollama — Ollama server bound to non-loopback interface by NemoClaw (Host-header validation skipped)
Vulnerable versions: Instances started with OLLAMA_HOST=0.0.0.0:11434
Fixed in: Bind to 127.0.0.1
Remediation for NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
Patches
- Update NVIDIA NemoClaw to a fixed release per the NVIDIA security bulletin (NVD lists Linux 0 through 0.0.25 as affected, fix commit f06796ff3; CSA and The Hacker News report v0.0.35 as the macOS/Linux fix and v0.0.106 as enforcing a loopback-only bind-address probe)
- Prefer v0.0.106 or later, which refuses non-loopback backends
Immediate actions
- Verify Ollama is bound to 127.0.0.1 only, not 0.0.0.0:11434; test actual network reachability rather than trusting version strings (on Linux, walk /proc/net/tcp and /proc/net/tcp6 for listeners on 11434)
- Rebuild any Ollama model whose chat template cannot be verified, from a trusted source
- Block browser and non-local traffic to local inference port 11434 with host firewall rules
- Audit Ollama API logs for unexpected /api/create and /api/pull calls and for template modifications
Workarounds
- Windows/WSL: no structural fix at disclosure (v0.0.34 only warns); manually force OLLAMA_HOST=127.0.0.1:11434 and firewall the port
- Avoid browsing untrusted sites on hosts running an exposed NemoClaw/Ollama backend
Longer-term hardening
- Baseline model configurations and chat templates and alert on drift
- Place an authenticated proxy in front of inference APIs; validate Host and Origin headers server-side and restrict authorized Host values
- Apply least privilege to AI agent tool access so a poisoned model has limited reach
- Monitor sensitive Ollama API activity (create, delete, pull) as part of AI-infrastructure logging
CVEs associated with NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
Weaknesses (CWE) in NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
Timeline of NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
- Ollama fixes DNS-rebinding issue CVE-2024-28224 in v0.1.29 (March 2024); NemoClaw's non-loopback bind later re-exposes the same class of attack
- NVIDIA NemoClaw introduced (March 2026 per CSA)
- Cyera acquires Oasis Security (July 2026 per CSA), the discoverer of the flaw
- NemoClaw v0.0.106 reported (per CSA) as enforcing a bind-address probe that refuses non-loopback backends on Linux/macOS
- CVE-2026-65105 published in NVD (CVSS 8.1, CWE-306) as part of an NVIDIA security bulletin covering 19 CVEs; fix commit f06796ff3 listed
- Oasis Security publicly discloses chat template poisoning via DNS rebinding after reporting to NVIDIA PSIRT; no known exploitation at disclosure
- Cloud Security Alliance publishes research note with detection guidance; reports v0.0.35 as macOS/Linux fix and Windows/WSL (v0.0.34) warning-only
- NSFOCUS publishes AI security incident case analysis of the NemoClaw chat template poisoning vulnerability
Sources cited for NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama
- AI Security Incident Case: NVIDIA's NemoClaw Chat Template Poisoning Vulnerability (NSFOCUS)
- NVD: CVE-2026-65105
- NVIDIA Patches High-Severity NemoClaw Flaw After Model-Poisoning Demo (eSecurity Planet)
- NemoClaw's Drive-By Model Poisoning: CVE-2026-65105 Explained (Cloud Security Alliance)
- DNS Rebinding in NemoClaw Enables Persistent Model Poisoning (Cloud Security Alliance)
- Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning (Cyera/Oasis Security)
- NemoClaw's AI can be poisoned through a browser tab (CSO Online)
- A Malicious Webpage Could Poison Your Local AI Model (The Hacker News)
- Oasis Discloses NVIDIA NemoClaw Flaw CVE-2026-65105 Letting Any Website Poison Local Ollama Models (AI Weekly)
Detection coverage for TL-2026-4428
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4428 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.