cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

NemoClaw Flaw Could Let Malicious Webpages Poison Local Ollama Models

· Original article ↗

Summary

Oasis Security says a browser-based attack can take control of a local Ollama instance and poison model instructions through NemoClaw. NVIDIA fixed macOS and Linux in v0.0.35; the Windows and WSL path reportedly remains affected.

Key points

  • Oasis Security reported the weakness to NVIDIA PSIRT before publication; the issue has no CVE, and no exploitation had been reported as of August 25, 2026.
  • The attack uses DNS rebinding to reach an unauthenticated local Ollama API from a browser session.
  • An attacker could use the API to alter a model’s chat template, planting instructions that persist across later conversations.
  • NemoClaw v0.0.35 fixed the issue on macOS and Linux, according to Oasis Security’s research lead.
  • The Windows and WSL path reportedly remains affected because it can bind Ollama to 0.0.0.0:11434 without authentication and does not start the protective proxy.
  • A NemoClaw proxy check introduced in v0.0.106 does not cover the Windows-host path; the repository review also found no chat-template integrity check.

Article Details

Vulnerability Types
  • DNS rebinding
  • Unauthenticated access to the local Ollama API
  • Chat-template poisoning
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
partial
Workarounds
  • Bind Ollama to 127.0.0.1 rather than 0.0.0.0.
  • Do not expose port 11434 to a LAN or the internet.

MITRE ATT&CK

T1189 · Drive-by CompromiseAn attacker-controlled webpage can use DNS rebinding and browser access to take over the local Ollama instance.T1565.001 · Stored Data ManipulationThe attacker modifies Ollama’s chat template through the API, persisting hidden instructions that affect later conversations.

CVE

CVE-2024-28224Ollama shipped a fix in v0.1.29 on March 14, 2024, and NCC Group published the advisory as CVE-2024-28224 the following month.

People

Elad LuzOasis Security’s head of research; described the platform-specific fix status and the Ollama Host-header validation behavior.

Vendors

NvidiaOasis Security disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take over a locally hosted Ollama instance and poison a model’s chat template with hidden instructions.

Products

NemoClawOasis Security disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take over a locally hosted Ollama instance and poison a model’s chat template with hidden instructions.OllamaOasis Security disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take over a locally hosted Ollama instance and poison a model’s chat template with hidden instructions.OpenClaw#NVIDIAOpenShellNemoClaw is NVIDIA’s open source reference stack for running agents such as OpenClaw inside its OpenShell sandboxes, and Ollama is one of its supported local inference backends.Paperclip#NVIDIA

Related Articles