NemoClaw Windows Configuration May Expose Ollama to Model Poisoning

Oasis Security has disclosed a potential attack chain affecting NVIDIA NemoClaw deployments that use a Windows-host Ollama configuration. A malicious webpage could take unauthenticated control of the local Ollama API on port 11434 and alter a model’s chat template, planting instructions that are applied during later agent conversations.

The report, shared with NVIDIA’s Product Security Incident Response Team, did not assign a CVE, an affected-version range or a patched release. As of August 25, 2026, no exploitation had been reported. NVIDIA NemoClaw is an open-source reference stack for running agents such as OpenClaw in OpenShell sandboxes, while Ollama is one of its supported local inference backends.

Windows-host path is central to the reported exposure

NemoClaw handles Ollama differently across platforms. On non-WSL systems, the local service normally remains on 127.0.0.1:11434 behind a token-gated reverse proxy listening on 0.0.0.0:11435. During onboarding, NemoClaw can also restart an Ollama daemon that is bound elsewhere so it listens only on loopback.

The Windows-host path differs because Docker Desktop containers need to reach the host daemon. It sets OLLAMA_HOST=0.0.0.0:11434, does not require authentication on that port, and does not start the NemoClaw proxy on the relevant WSL path. NVIDIA’s documentation advises operators not to expose port 11434 to a LAN or the internet, but the reported browser-based chain does not require a remote attacker to connect directly to that port.

DNS rebinding and poisoned templates

Oasis Security described a DNS rebinding scenario in which an attacker-controlled domain first resolves to the attacker’s server and later to 127.0.0.1. The browser continues to regard the request as same-origin. The report says that, when Ollama is not loopback-bound, its Host-header check is skipped; the CORS layer then permits requests whose Origin and Host headers use the attacker’s domain.

Once the API is reachable, the payload uses /api/create to write a modified Go chat template. Chat templates render structured messages into the raw text supplied to a model. The altered template appends attacker-controlled content to every system message at inference time, allowing the instructions to persist across later conversations even when the agent supplies its own system prompt.

Ollama addressed a DNS rebinding issue in version 0.1.29 on March 14, 2024. NCC Group published that issue as CVE-2024-28224 and recommended server-side Host-header validation against an authorized set of values. The new report does not state the browsers or operating systems on which its full chain was verified.

Proxy safeguard does not cover the cited path

The NemoClaw repository reviewed at commit 17f0ca3b contains a default check introduced in version 0.0.106 on August 10. The local Ollama proxy refuses to start if its backend is reachable on a non-loopback interface, warning that such a binding bypasses the proxy token check. Operators can disable that check with NEMOCLAW_OLLAMA_PROXY_SKIP_BIND_PROBE=1, and it does not fail closed where the probe cannot run.

However, the proxy check runs inside the proxy itself, and NemoClaw does not launch that proxy on the cited Windows-host configuration. The repository review also found no integrity check for a model’s chat template; NemoClaw queries Ollama’s /api/show endpoint for native context length and declared tool-calling capability, rather than template content.

For businesses operating NemoClaw, the immediate task is to identify Windows-host Ollama deployments, avoid disabling binding safeguards, keep port 11434 unavailable to networks, and review model chat templates for unexpected changes while NVIDIA and Oasis Security clarify the affected scope.