# NVIDIA NemoClaw Chat Template Poisoning via Exposed Ollama API and DNS Rebinding (CVE-2026-65105)

> NVIDIA NemoClaw launches its Ollama inference backend with OLLAMA_HOST=0.0.0.0:11434, exposing an unauthenticated API and disabling Ollama's Host-header validation. A malicious webpage can use DNS rebinding to reach the API, rewrite a model's chat template via /api/create, and persistently inject hidden instructions into every inference call. Disclosed by Oasis Security on 2026-08-25; no in-the-wild exploitation was reported at disclosure.

- **Published:** 2026-10-26T04:42:59Z
- **Last reviewed:** 2026-10-26T04:42:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4428
- **ID:** TL-2026-4428
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-65105

## Description

CVE-2026-65105 (CWE-306, Missing Authentication for Critical Function) affects NVIDIA NemoClaw, an agent toolkit that runs a local Ollama model server for OpenClaw-style agents. To let containers reach the host-side inference service, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434, binding the API to every interface instead of loopback. Ollama's API performs no authentication, and for non-loopback bindings Ollama skips its Host-header validation, the check designed to stop browsers from reaching local services. Only CORS handling remains, and DNS rebinding defeats it because Origin and Host then match.

Exploit chain (per Oasis Security, as reported by NSFOCUS, CSA, Cyera, CSO Online and The Hacker News): (1) the victim visits an attacker-controlled or compromised webpage; (2) the attacker's domain first resolves to the attacker's server (short TTL), then re-resolves to 127.0.0.1, so browser JavaScript treats requests to port 11434 as same-origin; (3) the script enumerates the instance (GET /api/tags, GET /api/show) and retrieves the model's Go chat template; (4) it builds a tampered Go template that appends attacker-controlled hidden instructions to every system message and writes it back with POST /api/create. Because the template is a model-level property, it is invisible to API consumers, survives client-supplied system prompts, session resets and restarts, and leaves no anomaly in conversation logs. The agent cannot override it, so the agent's tool-calling capabilities effectively become attacker-steerable.

Other capabilities demonstrated or listed: enumerating installed models and the Ollama version, extracting model details and system prompts, deleting models (DELETE /api/delete), arbitrary inference (/api/generate, /api/chat), and pulling large models to exhaust disk (/api/pull). NVD describes the impact as unauthorized information access and service disruption. The technique builds on the older Ollama DNS-rebinding issue CVE-2024-28224 (fixed in Ollama v0.1.29, March 2024); NemoClaw's non-loopback bind re-opens that exposure. Similar poisoned chat-template techniques have been documented against other agents (Paperclip, OpenClaw).

Version and patch information in the sources is inconsistent. NVD and eSecurityPlanet list NemoClaw for Linux versions 0 through 0.0.25 as affected (fixed commit f06796ff3, with version 0.0.25 appearing on both sides). CSA and The Hacker News report v0.0.35 as the practical fix for macOS and Linux, and v0.0.106 (reported as 2026-08-10) as adding an enforced bind-address probe that refuses non-loopback backends. Windows/WSL paths were not structurally fixed at disclosure: v0.0.34 added only an installer warning. Defenders should test actual network reachability of port 11434 rather than trust version strings. Not reported: public PoC release, in-the-wild exploitation, attacker infrastructure or malware IOCs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1082 System Information Discovery
- T1005 Data from Local System
- T1565 Data Manipulation
- T1485 Data Destruction
- T1496 Resource Hijacking
- AML.T0051 LLM Prompt Injection

## Sources

- [AI Security Incident Case: NVIDIA's NemoClaw Chat Template Poisoning Vulnerability (NSFOCUS)](https://nsfocusglobal.com/ai-security-incident-case-nvidias-nemoclaw-chat-template-poisoning-vulnerability/)
- [NVD: CVE-2026-65105](https://nvd.nist.gov/vuln/detail/CVE-2026-65105)
- [NVIDIA Patches High-Severity NemoClaw Flaw After Model-Poisoning Demo (eSecurity Planet)](https://www.esecurityplanet.com/vulnerabilities/news-nvidia-nemoclaw-cve-2026-65105/)
- [NemoClaw's Drive-By Model Poisoning: CVE-2026-65105 Explained (Cloud Security Alliance)](https://labs.cloudsecurityalliance.org/research/csa-research-note-nemoclaw-dns-rebinding-model-poisoning-202/)
- [DNS Rebinding in NemoClaw Enables Persistent Model Poisoning (Cloud Security Alliance)](https://labs.cloudsecurityalliance.org/research/csa-research-note-nvidia-nemoclaw-model-poisoning-20260827-c/)
- [Drive-By Agent Hijacking: One Website Visit, Persistent Model Poisoning (Cyera/Oasis Security)](https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent)
- [NemoClaw's AI can be poisoned through a browser tab (CSO Online)](https://www.csoonline.com/article/4214156/nemoclaws-ai-can-be-poisoned-through-a-browser-tab.html)
- [A Malicious Webpage Could Poison Your Local AI Model (The Hacker News)](https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html)
- [Oasis Discloses NVIDIA NemoClaw Flaw CVE-2026-65105 Letting Any Website Poison Local Ollama Models (AI Weekly)](https://aiweekly.co/alerts/oasis-discloses-nvidia-nemoclaw-flaw-cve-2026-65105-letting-any-website-poison)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4428