NVIDIA NemoClaw Flaw Enables AI Agent Hijack via DNS Rebinding

A critical vulnerability in NVIDIA's NemoClaw tool could allow an attacker to gain persistent control of a locally deployed AI agent through a single visit to a malicious website. The flaw, discovered by researchers from Oasis Security, enables the poisoning of an AI model's core instructions, creating a hidden backdoor that survives across conversations.

The vulnerability, tracked as CVE-2026-65105, resides in how NemoClaw configures the Ollama inference backend. To allow communication between its Docker-based OpenShell sandboxes and the host, NemoClaw starts Ollama with the setting OLLAMA_HOST=0.0.0.0:11434. This binds the service to all network interfaces instead of just the local loopback address, exposing its unauthenticated API to the local network.

Researchers Elad Luz and Ofek Itach from Oasis Security found that this configuration bypasses a critical Host header validation check in Ollama. This creates an opening for a DNS rebinding attack. In such an attack, a victim visits a domain controlled by the attacker, which initially resolves to the attacker's server. The attacker then changes the domain's DNS resolution to point to the victim's own machine (127.0.0.1)....