--- title: "NemoClaw’s AI can be poisoned through a browser tab" url: https://daily.dev/posts/nemoclaw-s-ai-can-be-poisoned-through-a-browser-tab-y7zusycqg source_url: https://www.csoonline.com/article/4214156/nemoclaws-ai-can-be-poisoned-through-a-browser-tab.html type: article source: "CSO Online" published: 2026-08-26T11:41:00.290Z updated: 2026-08-26T16:11:45.102Z tags: ["ai-agents", "nvidia", "prompt-injection", "ollama"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # NemoClaw’s AI can be poisoned through a browser tab **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary A vulnerability in Nvidia's NemoClaw, tracked as CVE-2026-65105, lets an attacker take control of a victim's local Ollama model server through a single malicious website visit, using DNS rebinding to bypass Ollama's Host-header checks. Because NemoClaw binds Ollama to 0.0.0.0 to allow container access, an attacker can trick a browser into reaching the local API, then poison the model's chat template rather than the system prompt so malicious instructions persist across future conversations, invisible to OpenClaw's own safeguards. Nvidia has patched macOS and Linux in NemoClaw 0.0.35, but Windows/WSL remains unfixed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-65105 in Nvidia's NemoClaw and how does it work? CVE-2026-65105 is a DNS rebinding vulnerability that gives attackers unauthenticated access to NemoClaw's local Ollama server through a single malicious webpage visit. Because NemoClaw binds Ollama to 0.0.0.0:11434 for Docker container connectivity, it skips Ollama's Host-header validation, letting a rebound DNS request reach the local API and manipulate the model's chat template with persistent malicious instructions. _Track vulnerabilities like this affecting local AI agent setups by following security coverage on daily.dev._ ### Why does NemoClaw bind Ollama to 0.0.0.0 instead of localhost? NemoClaw runs Ollama with OLLAMA_HOST=0.0.0.0:11434 because its OpenShell sandbox runs inside a Docker container that cannot reach a service listening only on the loopback address 127.0.0.1. This solves container connectivity but disables Ollama's Host-header validation, which normally blocks unauthorized browser access, exposing the API to DNS rebinding attacks. _Developers configuring local model servers can follow security tradeoffs like this on daily.dev._ ### Is NemoClaw's DNS rebinding vulnerability patched? Yes, Nvidia patched the flaw in NemoClaw version 0.0.35 for macOS and Linux systems. Windows and WSL installations remain unfixed as of that release, and Nvidia had not responded to a request for comment on a timeline for those platforms. _Developers running NemoClaw can stay current on patch status by tracking updates on daily.dev._ ## Similar posts on daily.dev - [I ran Nvidia's NemoClaw to see if OpenClaw is finally safe, but it still has the same problems](https://daily.dev/posts/i-ran-nvidia-s-nemoclaw-to-see-if-openclaw-is-finally-safe-but-it-still-has-the-same-problems-rhnvxn8jt) · XDA Developers · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#nvidia](https://daily.dev/tags/nvidia), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#ollama](https://daily.dev/tags/ollama) [View this post on daily.dev](https://daily.dev/posts/nemoclaw-s-ai-can-be-poisoned-through-a-browser-tab-y7zusycqg)