NemoClaw CVE-2026-65105: One Browser Visit Rewrote the Model's Chat Template

On 25 August 2026 NVIDIA published security bulletin 5872 and rated a flaw in NVIDIA NemoClaw, the Linux tool that runs OpenClaw agents inside OpenShell sandboxes, as High with a CVSS base score of 8.1. CVE-2026-65105 is a missing-authentication bug: NemoClaw starts the Ollama inference server on every network interface, and Ollama's API has no authentication of its own. Oasis Security researchers, credited by name in NVIDIA's acknowledgements and now being acquired by Cyera, built a demonstration in which one visit to an attacker-controlled webpage was enough to reach that server from inside the browser and rewrite the model's chat template — an edit that outlived later conversations and survived the agent supplying its own system prompt. No exploitation in the wild has been recorded. The full entry, with its severity and confidence grades, sits in the Orca AI Incident Archive alongside the neighbouring incidents from the same month.

What NVIDIA published

The bulletin is titled "Security Bulletin: NVIDIA NemoClaw and OpenShell - August 2026", numbered 5872, and its revision history records a single entry: version 1.0.0, dated 2026-08-25. It is a round-up, not a single-CVE advisory — the affected-products table inside it lists eighteen CVEs across two products, from CVE-2026-65081 through CVE-2026-65105. The largest item in the batch is CVE-2026-65093, a sandbox escape in NVIDIA OpenShell for Linux rated 9.9 Critical.

For CVE-2026-65105 the bulletin states the flaw "in its inference server setup, where a remote attacker may access the inference service without authentication", and that a successful exploit "may lead to information disclosure and denial of service". The published vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H — adjacent network, low complexity, no privileges, no user interaction, high confidentiality impact, high availability impact — and the weakness class is CWE-306, "Missing Authentication for Critical Function".

NVIDIA's affected-products table gives the affected versions as "0 to 0.0.25" for NemoClaw on Linux, and the updated version as "f06796ff3; 0.0.25" — a commit hash paired with the same version number that appears in the affected column. eSecurity Planet, reporting the flaw on 27 August 2026, flags exactly that overlap and advises administrators to "verify that deployed code contains the fixing commit rather than relying on the version number alone".

The acknowledgement section credits "CVE-2026-65105: Markus Halvorsen, Elad Luz of Oasis Security". The NVD record for the CVE was published on 25 August 2026 at 21:17 UTC and last modified on 1 September 2026; it carries NVIDIA's 8.1 score as the only CVSS v3.1 assessment, and the CVE does not appear in CISA's Known Exploited Vulnerabilities catalogue.

One detail in NVIDIA's own entry is worth naming rather than smoothing over. The vector has no integrity component at all — I:N, integrity impact none — and the one-line description mentions only information disclosure and denial of service. The researchers' central claim, discussed below, is that the model's chat template was modified and stayed modified. That reading of the vector is ours, not NVIDIA's: the company has published no statement on whether the template-rewriting path was considered when the score was assigned.

The setup that made a local server reachable

NemoClaw deploys OpenClaw agents inside an OpenShell sandbox, and it supports Ollama as a local inference backend. The configuration problem is a side effect of that arrangement. As Cyera's research write-up by Elad Luz and Ofek Itach explains, OpenShell runs in Docker, so an Ollama server on the default loopback address is unreachable from inside the container. NemoClaw therefore starts Ollama with OLLAMA_HOST=0.0.0.0:11434, which binds port 11434 on every interface rather than only on the host's loopback. The same write-up notes that the installer displays "Using Ollama on localhost:11434" even though the actual bind is considerably wider.

Ollama's API has no authentication. Its browser-facing defences are two: a CORS middleware that treats a request whose Origin equals its Host as same-origin and lets requests with no Origin header pass, and a Host-header validation step that normally accepts only local hostnames. The second defence is the one that disappears under NemoClaw's configuration. Cyera's account is explicit that "when Ollama is bound to a non-loopback address (such as 0.0.0.0), the Host header validation is skipped entirely" — the code checks whether the bind address is loopback and bypasses the check otherwise.

That combination is what makes DNS rebinding work. A visitor loads a page from a domain the attacker controls, with the page's JavaScript addressing port 11434. The attacker's DNS then re-resolves that same domain to 127.0.0.1 or to an address on the victim's local network. Because the browser's same-origin policy is keyed to the hostname, and the hostname has not changed, the browser keeps treating the request as same-origin. Ollama receives it, skips Host validation because its bind is non-loopback, and sees Origin equal to Host — both being the attacker's domain — so the CORS layer allows it. Cyera's summary of the result is "full, unauthenticated API access". The attacker needs control of nothing but their own domain; no foothold on the victim's network or DNS infrastructure is required.

The sandbox did not cover this because the flaw sits below it. eSecurity Planet describes the bug as sitting "in the inference layer beneath those sandbox controls", so sandboxing the agent left the model server it talks to unprotected. Cyera makes the same point more broadly: "Sandboxing the agent is necessary but not sufficient." The Cloud Security Alliance's research note on the case, dated 27 August 2026, adds that non-loopback binding revives the exposure behind an earlier Ollama rebinding issue tracked as CVE-2024-28224.

Worth stating plainly, because it is a separate exposure path from the browser attack: binding to 0.0.0.0 also puts the unauthenticated API on the local network directly, so any host that can route to port 11434 reaches it without DNS rebinding at all.

From a readable template to a rewritten one

Once JavaScript can reach the API, the reconnaissance is mundane. Cyera lists what was reachable in the demonstration: the installed model names, sizes, families and quantizations from GET /api/tags, the exact Ollama version from GET /api/version, model details, system prompts, templates and licences from POST /api/show, and the hostname and public key — or the signed-in username — from POST /api/me. The destructive endpoints were reachable too: POST /api/pull to download arbitrary models and fill the disk, POST /api/push to push models to ollama.com under the victim's account, DELETE /api/delete to remove the victim's models, and POST /api/signout. Inference endpoints, including the OpenAI-compatible /v1/chat/completions route, would run prompts on the victim's GPU.

The persistence came from one of those endpoints. Cyera's write-up explains that injecting a hidden system field through POST /api/create was ineffective against OpenClaw, because the agent sends its own system prompt in the messages array and that overrides the model's built-in system field. The stronger route is the template field that /api/create also accepts. An Ollama chat template is a Go template that controls how messages are rendered into raw text before inference, and "the template is applied at inference time to all messages, including any system prompt the client sends". In the demonstration the attacker fetched the original template through /api/show, spliced the injection into it while keeping tool rendering, special tokens and role formatting intact, and re-uploaded it.

What follows from that placement is the part that matters. According to Cyera, the modification persists across all future conversations with the model, survives client-supplied system prompts, is invisible to the user because the model's name, size, metadata and capabilities look unchanged, and affects every consumer of the model — CLI, API clients and agents alike. The write-up's own framing is that "the client cannot detect or prevent this" because the template is "a model-level property invisible to API consumers". CSO Online, reporting the case on 26 August 2026, quotes Luz describing the template as sitting "one layer beneath anything a guardrail or an operator can see", and notes that the change survives every future session.

The consequences Cyera lists for an agent running on a poisoned template are potential, not observed: inserting vulnerabilities into generated code, suppressing security warnings, steering recommendations toward attacker-controlled packages, URLs or configurations, and exfiltrating conversation or file data where outbound access exists. The write-up is also careful about what the sandbox still bounds — host-level filesystem, network and process actions — while noting that the agent's authorised access to source control, CI/CD, internal APIs, cloud services and MCP servers is where the real exposure lies.

What the demonstration showed, and what it did not

The proof of concept ran in four steps, as Cyera describes it. The researchers connected to a NemoClaw sandbox and sent a prompt; the agent responded normally. They then opened a webpage that performed DNS rebinding against the local Ollama server. That page read the Ollama version, the installed models, the hostname and the public key, and poisoned the model template with a hidden instruction. Resending the same prompt returned a response containing the injected marker, with no change made to the sandboxed agent itself.

That is the strongest form of the claim the researchers are making, and it is also where the record's limits begin. This is a demonstration under a specific configuration — Ollama started with OLLAMA_HOST=0.0.0.0:11434 — and not a survey of deployed systems. No victim is named anywhere in the coverage reviewed for this piece: not in NVIDIA's bulletin, not in the NVD record, not in Cyera's write-up, not in CSO Online's or eSecurity Planet's reporting. No count of exposed NemoClaw installations has been published by any of them, and none of them reports exploitation in the wild. The absence of a CISA KEV listing is a fact about the catalogue, not proof that nobody tried.

Independent comment came from Randolph Barr of Cequence Security, quoted by CSO Online: "DNS rebinding's been a browser party trick for over a decade", he said, while "pointing it at an unauthenticated local model server is the new part". That is a fair description of the novelty here — the browser technique is old and the target class is new — and it is also a reminder that the disclosure rests on one research team's demonstration. No independent replication of the template-poisoning result was found in the coverage reviewed for this article.

The fix, and the Windows gap

The commit NVIDIA names as the fix, f06796ff3, is titled "fix(security): bind Ollama to localhost with authenticated proxy". Read against the public repository, it does three things. It changes the local inference path so Ollama is started on 127.0.0.1:11434 instead of 0.0.0.0:11434. It adds a small authenticated reverse proxy, scripts/ollama-auth-proxy.js, which listens on 0.0.0.0:11435 and validates a bearer token generated per instance at onboarding and stored in the OpenShell provider credential, so the containerised gateway can still reach inference while anything without the token gets a 401; GET /api/tags is deliberately exempted for container health checks. And it updates the setup script and the local-inference tests to the proxy port. The commit message records the internal ticket as "PSIRT bug 6002780, CVSS 7.5 High", against the 8.1 NVIDIA later published for the CVE.

The remediation status beyond that commit is where the sources diverge, and the divergence should be reported rather than resolved. CSO Online reports that "the flaw has now been patched by Nvidia for non-Windows systems". The Cloud Security Alliance note of 27 August 2026 is more specific: it says macOS and Linux were corrected in v0.0.35, that a later build, v0.0.106, refuses to start unless Ollama is loopback-bound, and that "NVIDIA's remediation covers macOS and Linux but, as of publication, does not extend to Windows or WSL". In that account the startup check "does not reach the code path used on Windows and WSL", v0.0.34 "added only a warning rather than enforcing loopback binding", and "Windows and WSL deployments remained exposed at disclosure time". NVIDIA's own bulletin supports only part of this: its affected-products table scopes CVE-2026-65105 to Linux, gives a single updated commit and version, and lists no Windows entry either as affected or as fixed. NVIDIA did not respond to that discrepancy in any document reviewed here.

NVIDIA's public statement came after publication, in CSO Online: "We appreciate the researchers' discovery and report", the company said, adding that "Nvidia has issued an update that customers can download and install".

The operator-side measures listed by eSecurity Planet are the practical remainder of the record:

• Update NemoClaw and confirm the deployed code contains commit f06796ff3, rather than trusting the version string, since 0.0.25 appears in both the affected and the updated column.

• Restrict Ollama to 127.0.0.1 unless wider access is explicitly needed, which removes the non-loopback bind that causes Host validation to be skipped.

• Put an authenticated proxy and firewall controls in front of inference services rather than relying on the application's own network boundary.

• Monitor listening interfaces, model templates, model settings and API activity for unexpected change, since the poisoned template leaves the model's name, size and metadata untouched.

• Keep known-good copies of model templates and settings for tamper detection and recovery, and test incident-response plans for model poisoning and exposed inference — isolation, integrity checks, credential rotation and restoration.

• Apply least privilege to everything the agent can reach: repositories, CI/CD systems, APIs, cloud resources and credentials, because the sandbox bounds host actions but not the entitlements the agent was given.

What is established, what is attributed, and what is not known

Established. NVIDIA published bulletin 5872 on 25 August 2026 with CVE-2026-65105 rated 8.1 High, CWE-306, affecting NemoClaw for Linux versions 0 to 0.0.25 and fixed at commit f06796ff3. The NVD record corroborates the score, vector and weakness class independently of the bulletin's own page. NVIDIA's acknowledgement names Markus Halvorsen and Elad Luz of Oasis Security. The public commit named as the fix changes the bind to loopback and introduces a token-authenticated proxy on port 11435. The CVE is not in CISA's Known Exploited Vulnerabilities catalogue.

Attributed. That one webpage visit is sufficient to rewrite a model's chat template and that the change survives later sessions and client-supplied system prompts is the finding of Oasis Security, reported through Cyera's research write-up and carried by CSO Online and eSecurity Planet. That macOS and Linux were remediated in v0.0.35 and v0.0.106 while Windows and WSL were only warned in v0.0.34 is the Cloud Security Alliance's account; CSO Online's shorter version of the same claim is that the patch covers non-Windows systems. The list of downstream agent consequences — vulnerable code, suppressed warnings, attacker-steered packages, data exfiltration — is Cyera's description of potential effects, not an observed outcome.

Not established. How many NemoClaw deployments ran with the 0.0.0.0 bind, and how many were reachable from an adjacent network, has not been published by anyone. Whether the poisoning path was priced into NVIDIA's 8.1 score is unknown — the published vector carries no integrity impact, and NVIDIA has said nothing about it either way. No victim, no incident report and no in-the-wild exploitation has been recorded by any source reviewed here, and no second research group has published a replication.

The record itself is a research finding, not a deployment event: the archive entry carries high severity with an A confidence grade, records no real-world harm, and marks it undisputed. That matches what the sources show — a well documented vulnerability with a demonstrated exploit and no reported casualties — and it is the reason this piece separates the demonstration from its consequences rather than treating the two as one claim.