Reported by 2 outlets
NVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS Rebinding
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
NVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS Rebinding
gbhackers.com · 48d ago · August 26th, 2026
A critical vulnerability in NVIDIA NemoClaw, tracked as CVE-2026-65105, could enable attackers to gain persistent control of locally deployed AI agents through a single visit to a malicious website. Researchers Elad Luz and Ofek Itach from Oasis Security discovered that NemoClaw’s local Ollama configuration exposes an unauthenticated API, making it susceptible to DNS rebinding attacks. […] The post NVIDIA NemoClaw Vulnerability Lets Attackers Hijack AI Agents via DNS Rebinding appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
NVIDIA NemoClaw Flaw Lets Attackers Hijack AI Agents Through DNS Rebinding
cyberpress.org · 48d ago · August 26th, 2026
The issue combines an insecure Ollama network configuration with DNS rebinding, allowing unauthenticated access to the local model server and persistent poisoning of the model template used by OpenClaw agents . NemoClaw runs the OpenClaw AI agent in NVIDIA OpenShell sandboxes and supports Ollama for local inference. This arrangement allows developers to process prompts and code on hardware instead of sending data to a cloud API. NVIDIA NemoClaw Flaw OpenShell sandboxes run inside Docker containers; however, this creates a connectivity challenge: containers cannot reach an Ollama service listening only on the host loopback interface. To address that limitation, NemoClaw starts Ollama with OLLAMA_HOST=0.0.0.0:11434 . The configuration makes the service accessible to containers, but it also binds Ollama to every network interface. NemoClaw reportedly describes the service as running on localhost:11434 , despite the underlying listener being reachable from the local network. Ollama exposes an HTTP API on port 11434 without authentication. Its security controls instead rely on CORS enforcement and Host-header validation to limit requests originating from web pages. Researchers Elad Luz and Ofek Itach found that Ollama skips Host-header validation when it is bound to a non-loopback address, including 0.0.0.0 . That leaves CORS as th