CVE-2026-65105Disclosure(linux / linux_kernel)

A single webpage visit can permanently poison your local AI model. Oasis Security has disclosed CVE-2026-65105 in NVIDIA's NemoClaw, allowing an attacker-controlled webpage to take unauthenticated control of a local Ollama instance and plant persistent hidden instructions inside the model. The attack uses DNS rebinding to reach Ollama's unauthenticated API on port 11434. NemoClaw binds Ollama to 0.0.0.0 on Windows. This makes the API reachable from the browser and bypasses the Host header validation that Ollama introduced to prevent exactly this attack (CVE-2024-28224). Once the API is reachable, a modified Go template writes attacker-controlled text to every system message at inference time. The poisoning persists across conversations and is invisible to API consumers. NVIDIA fixed the issue on macOS and Linux in v0.0.35. The Windows and WSL path remains unfixed. The local AI infrastructure is becoming an attack surface accessible through the browser. Sandboxing protects the endpoint, but compromising the agent gives the attacker access to its tools. Organizations deploying local AI models need to consider whether their inference endpoints are exposed and whether browser-to-localhost attack paths are being monitored. If you are running local AI models, how are you validating that your inference endpoints are not accessible through the browser via DNS rebinding?

.@cyera_io and @oasissec research teams have found CVE-2026-65105 in @nvidia NemoClaw: one webpage visit gives an attacker full control of the model behind the OpenClaw agent, no credentials needed. Using DNS rebinding, the attacker reaches the local Ollama API and poisons the model's chat template. The instructions stick around, surviving even the agent's own system prompt. Binding local Ollama to loopback only closes this path. Details: https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent

NVIDIA NemoClawに、悪意あるWebサイトを閲覧しただけでローカルのOllamaへアクセスされ、AIエージェントの挙動を永続的に改変され得る重大な脆弱性「CVE-2026-65105」が見つかった。Cyeraが報告した。 問題は、NemoClawがDockerコンテナからホスト上のOllamaへ接続するため、OLLAMA_HOST=0.0.0.0:11434で起動する設定にある。これによりOllamaが全IFで待ち受ける。 攻撃者はDNS rebindingを使い、被害者が開いた悪性サイトのドメインを後から127.0.0.1などへ向ける。JavaScriptは同一オリジンのまま、認証のないOllama APIへアクセスできるという。 APIからモデル生成、モデル取得・削除、設定変更ができ、GPU悪用やディスク枯渇、情報取得につながる。最も重大なのはモデルテンプレートの改変で、以後のシステムプロンプトに隠れた命令を追加できる。 Cyeraによると、改変されたモデルは脆弱なコード生成、警告の抑制、悪意あるパッケージ推奨、機密データ送信などへAIエージェントを誘導し得る。 https://cybersecuritynews.com/nvidia-nemoclaw-flaw/

Oasis Security disclosed a high-severity vulnerability in NVIDIA NemoClaw (CVE-2026-65105) that lets an attacker gain full control over a local Ollama model, inject persistent hidden instructions, and abuse multiple API endpoints. https://nsfocusglobal.com/ai-security-incident-case-nvidias-nemoclaw-chat-template-poisoning-vulnerability/

One website visit is enough to rewrite the model your local agent is using. Oasis Security (now under Cyera) published CVE-2026-65105 against @NVIDIA NemoClaw. NemoClaw runs OpenClaw agents inside OpenShell sandboxes and, for local inference, starts Ollama with OLLAMA_HOST=0.0.0.0:11434. That bind is how the container reaches the host. It also turns off Ollama’s Host-header check. Ollama’s API on 11434 has no auth. DNS rebinding does the rest. Victim loads an attacker domain. DNS flips to loopback or a LAN address. Browser treats it as same-origin. CORS passes. Full unauthenticated Ollama API. From there the page can list models, pull or delete them, burn GPU, and — the part that actually matters — call /api/create and rewrite the model’s Go chat template. A hidden system field gets overwritten when the agent sends its own system prompt. The template does not. It renders every future message, including the agent’s system prompt, with the attacker’s extra instruction still attached. Name, size, and metadata look unchanged. @NVIDIA rates it High (CVSS 8.1). Linux/macOS NemoClaw through 0.0.25 is in the affected set; 0.0.35 is the version to confirm, and you should check the bind address yourself rather than trust the version string. Same-LAN devices can hit the API with no rebinding at all. What to do today: 1. Find every box running Ollama or NemoClaw. If it is listening on 0.0.0.0:11434, treat it as exposed. 2. Bind Ollama to loopback unless a container actually needs it. If it needs it, put it behind a host firewall and do not skip Host validation. 3. Diff installed model templates against a known-good /api/show dump. A poisoned template will not show up in EDR. 4. Do not give a local agent production SCM, CI, or MCP access until the inference endpoint is locked down. 5. Patch NemoClaw and re-check Windows/WSL paths. Some reports still flag those as lagging. Source: Oasis/Cyera write-up, “Drive-By Agent Hijacking,” CVE-2026-65105. NVIDIA PSIRT notified before publication. No public claim of in-the-wild exploitation as of Aug 28. Anyone already inventorying local Ollama binds, or still treating 11434 as “just localhost”? #AIAgents #AppSec #CVE

🤖 NVIDIA’s NemoClaw has a high-severity flaw (CVE-2026-65105) that could let a malicious website hijack local AI agents via DNS rebinding. Attackers could poison model templates and influence future agent actions. Update now. #CyberSecurity #AI Read more: https://thecyberedition.com/nvidia-nemoclaw-flaw-cve-2026-65105-enables-ai-agent-hijacking-via-malicious-websites/

Researchers just showed one webpage visit can hijack a "local" AI agent (CVE-2026-65105). NemoClaw started Ollama bound to 0.0.0.0 — any malicious site could rewrite the model's chat template and plant persistent hidden instructions. 1/3 https://t.co/ozbzXZpwev

CISO Daily Briefing: GPT-6 Astra crossed AI's "critical" cyber threshold, gated behind OpenAI's Daybreak. Shai-Hulud npm worm scans 469 credential paths, 2x prior. NemoClaw (CVE-2026-65105): DNS rebinding hijacks Ollama's chat template via exposed 0.0.0.0 binds. Gov: CA SB 53's 15-day incident-disclosure rule meets its first test, undercut by an "evaluation" loophole. Strategic: Google/Anthropic/OpenAI vetted-access tiers split defense into haves/have-nots. https://labs.cloudsecurityalliance.org/ciso-daily-briefing-september-5-2026/

CVE-2026-65105 (CVSS 8.1) in NVIDIA NemoClaw binds Ollama to 0.0.0.0:11434 with no auth, letting a malicious page use DNS rebinding to poison the chat template via /api/create. Audit Ollama model definitions for unexpected template changes. #DFIR_Radar https://t.co/Zq6LT09jzG

Nvidia NemoClaw tiene un fallo que deja tu Ollama local expuesto. CVE-2026-65105. Si usas la herramienta de Nvidia para correr modelos en local, el servicio se bindea a 0.0.0.0:11434 sin autenticación. Cualquier página web puede inyectar instrucciones persistentes en el modelo. El ataque es DNS rebinding + API sin auth. La página maliciosa habla con el puerto 11434 de tu máquina. Puede cambiar el system prompt, el chat template o meter memoria envenenada.Todo sin que tú instales nada extra. Solo con el navegador abierto y NemoClaw corriendo. Oasis Security lo publicó hace poco. El vector afecta la ruta de Windows-host de Ollama. No necesita privilegios elevados. Solo que el servicio esté escuchando en todas las interfaces, que es el default.Una vez inyectado, el modelo se comporta distinto en las siguientes sesiones. Si montas agentes locales o scrapers con Ollama + NemoClaw, revisa ya: - Bind solo a 127.0.0.1 - Autenticación o firewall delante - No dejes el puerto abierto a la red El “local” deja de ser local en cuanto el navegador puede hablar con el puerto. La promesa de la IA en tu máquina era privacidad y control. Un bind por defecto lo convierte en otro vector de supply-chain.Mismo patrón de siempre: la herramienta útil sale con el puerto abierto “para facilitar”. Luego alguien lo usa en sentido contrario.

NVIDIA NemoClaw の脆弱性 CVE-2026-65105：DNS リバインディングによる AI エージェントの乗っ取り https://iototsecnews.jp/2026/08/26/nvidia-nemoclaw-vulnerability-lets-attackers-hijack-ai-agents-via-dns-rebinding/ NVIDIA NemoClaw に重大な脆弱性 CVE-2026-65105 が発見されました。開発元のデフォルト設定ミスによって Ollama の API アクセス制限が機能せず、悪意のある DNS リバインディング攻撃を受けるリスクが存在します。悪質 Web サイトの閲覧／未認証 API の悪用／モデル・テンプレートの不正改ざん／バックドアの挿入といった被害が発生し、AI エージェントの制御権喪失や情報漏洩を引き起こします。安全を確保するため、バインド設定の見直し／ポート 11434 のアクセス制限／テンプレート監査の実施が求められます。 #CVE202665105 #NemoClaw #NVIDIA #Vulnerability

2. Nvidia「NemoClaw」の脆弱性、閲覧だけでローカルAIが乗っ取られる恐れ 重要度: ★★★★ セキュリティ企業Oasis Securityは2026年8月25日、NvidiaのAIエージェント展開ツール「NemoClaw」に深刻な脆弱性(CVE-2026-65105)があると公表した。SiliconANGLEやCybersecurity News、GBHackersなどが報じた。NemoClawはローカルのOllama(ポート11434)を認証なしで外部公開する設定になっており、悪意あるウェブサイトを一度閲覧しただけでDNSリバインディング攻撃によりチャットテンプレートを書き換えられ、以後のやり取りに攻撃者の指示が恒久的に埋め込まれる恐れがある。macOS・Linux向けはv0.0.35で修正済みだが、Windows/WSL版は本稿執筆時点で未修正。 何が重要か: コスト削減やデータ主権を目的にオープンソースLLMをローカル運用する動きが広がる中、その入り口となるツール自体が攻撃対象になり得ることを示した。 影響: Ollama等でローカルAIを運用している中小企業は、11434番ポートが外部からアクセス可能になっていないか至急確認し、必要ならファイアウォールで遮断すべき。

Entras a una web. Tu agente de IA ya no es tuyo Qué pasó: Oasis publicó el CVE-2026-65105 en Nvidia NemoClaw. Una visita a un sitio malicioso llega al servidor local del modelo y le planta instrucciones que sobreviven al prompt del agente. El sandbox no las ve. Nvidia lo listó en su boletín. Cómo cambia tu realidad: “corre en tu máquina” no quiere decir privado. Local es dónde corre. No quién lo toca. Lo esencial: El agente puede obedecerte y, por debajo, a otro.

Devs running AI agents locally: patch NVIDIA NemoClaw now. CVE-2026-65105 lets a malicious site DNS-rebind into an unauthenticated Ollama server, seize control, and poison your model. One visit can be enough. https://t.co/aZHzMz6ER5

NemoClaw plumbing failure - CVE-2026-65105 lets a webpage reach an Ollama server bound to 0.0.0.0:11434 via DNS rebinding. Attackers can edit Ollama templates to inject hidden instructions into the model definition - persistent model poisoning below operator view.

Researchers from Oasis Security have disclosed CVE-2026-65105, a DNS rebinding vulnerability in NVIDIA's NemoClaw AI agent that lets a single visit to a malicious webpage take over the agent without credentials or phishing. The flaw could expose any source control or cloud account the agent can access, and while NVIDIA has patched it, organizations need to ensure local NemoClaw instances are updated promptly. Get the technical details and mitigation steps in the full article: https://zpr.io/cD4TmGa3NzmQ #AI #CyberSecurity #NemoClaw #NVIDIA

🌐 #Vulnerabilidad crítica en Nvidia NemoClaw permite hackear agentes de IA al visitar webs | CVE-2026-65105 (+MITIGACIÓN) https://www.newstecnicas.com/2026/08/vulnerabilidad-critica-en-nvidia.html

🌐 Vulnerabilidad crítica en Nvidia NemoClaw permite hackear agentes de IA al visitar webs | CVE-2026-65105 (+MITIGACIÓN) https://www.newstecnicas.com/2026/08/vulnerabilidad-critica-en-nvidia.html

🌐 Vulnerabilidad crítica en Nvidia NemoClaw permite hackear agentes de IA al visitar webs | CVE-2026-65105 (+MITIGACIÓN) https://www.newstecnicas.com/2026/08/vulnerabilidad-critica-en-nvidia.html

🌐 Vulnerabilidad crítica en Nvidia NemoClaw permite hackear agentes de IA al visitar webs | CVE-2026-65105 (+MITIGACIÓN) https://www.newstecnicas.com/2026/08/vulnerabilidad-critica-en-nvidia.html