On August 25, 2026, Oasis Security revealed a vulnerability in NVIDIA NemoClaw that allows a webpage controlled by an attacker to take over a local Ollama instance on your machine. Although no exploitation has been reported, the attack is simple: visit a malicious page, and it can inject hidden instructions into your AI model. NemoClaw v0.0.35 fixed the issue on macOS and Linux, but Windows and WSL paths remain unpatched.
Understanding the Vulnerability
NemoClaw lets you interact with local AI models through a browser interface, connecting to Ollama, which runs a local API server on port 11434. This API lacks authentication and relies on middleware to block requests from browsers.
The flaw lies in DNS rebinding, which bypasses the middleware:
- You visit
attacker.com. - The attacker's DNS server resolves to their IP.
- After loading, the DNS changes to
127.0.0.1. - JavaScript on the attacker's page makes requests to
localhost:11434. - The middleware sees a request from
attacker.com, not a browser, and allows it. - The attacker injects system prompts or extracts data from your model.
You don't need to install anything or click a suspicious link, just visiting a webpage while Ollama is running is enough.
Timeline of Events
- Pre-August 2026: Vulnerability exists in NemoClaw's default configuration.
- August 25, 2026: Oasis Security reports to NVIDIA PSIRT.
- August 25, 2026: NemoClaw v0.0.35 released with fixes for macOS and Linux.
- Present: Windows and WSL deployments remain vulnerable.
Failed Security Controls
No API Authentication: The API on port 11434 accepts any request passing the middleware check, with no token, certificate validation, or session management. If you can reach the port, you can control the model.
Insufficient Origin Validation: The middleware blocks requests with browser-like headers but doesn't validate the DNS resolution chain. DNS rebinding exploits the gap between initial page load and subsequent requests.
Default Binding to All Interfaces: Many Ollama deployments bind to 0.0.0.0 instead of 127.0.0.1, expanding the attack surface beyond localhost.
No Runtime Integrity Checks: Once an attacker injects a system prompt, there's no mechanism to detect or alert on the modification.
Compliance Standards
OWASP ASVS v4.0.3, Requirement 4.3.1: The Ollama API uses neither session tokens nor static API secrets, violating this requirement.
NIST 800-53 Rev 5, Control AC-3: Binding to all interfaces without authentication violates access enforcement controls.
OWASP Top 10 2021, A07:2021, Identification and Authentication Failures: Systems with no authentication, like the Ollama API, fall into this category.
ISO/IEC 27001:2022, Annex A.9.4.1: There's no access control policy when the API is open to any localhost request.
PCI DSS v4.0.1, Requirement 2.2.6: Default bindings and lack of authentication are misconfigurations that enable misuse.
Actionable Steps
Bind Services to Specific Interfaces: If using Ollama locally, bind it to 127.0.0.1 only. Check your configuration file and set OLLAMA_HOST=127.0.0.1:11434.
Implement Local Service Authentication: Add an API key or mutual TLS to your Ollama deployment. Use a reverse proxy like nginx or Caddy to enforce this.
Monitor DNS Resolution Patterns: Log DNS queries and watch for rapid changes in resolution for the same hostname. DNS rebinding attacks show up as a domain resolving to an external IP, then to localhost.
Upgrade NemoClaw on macOS and Linux: Version 0.0.35 addresses the middleware bypass. For Windows or WSL, wait for a patch or implement compensating controls.
Audit Your AI Deployment Surface: Map every API endpoint your models expose. Document authentication requirements and network reachability.
Test for DNS Rebinding: Use a tool like singularity to verify whether your middleware blocks rebinding attacks.
Separate AI Workloads by Trust Level: Run sensitive data analysis models in isolated VMs or containers with strict network policies.
This vulnerability highlights the overlooked risks of local AI model deployment. Your browser is the attack surface, and your localhost is the target. Secure configurations are more important than ever.
