Executive Summary
In August 2026, Oasis Security disclosed a critical vulnerability in NVIDIA NemoClaw that allows malicious webpages to gain unauthenticated control over local Ollama AI model instances through DNS rebinding attacks. The vulnerability exploits NemoClaw's configuration that binds Ollama to all network interfaces (0.0.0.0:11434) on Windows and WSL systems, bypassing authentication and CORS protections. Attackers can poison AI model chat templates with hidden instructions that persist across conversations, effectively taking control of AI agents and their associated tools and permissions. NVIDIA partially addressed the issue in v0.0.35 for macOS and Linux, but Windows installations remain vulnerable with only warnings implemented.
This vulnerability highlights the growing attack surface of AI infrastructure and the critical need for secure-by-default configurations in AI development frameworks, particularly as organizations rapidly deploy AI agents with access to sensitive systems and data.
Why This Matters Now
AI agents are increasingly deployed with broad system access and decision-making capabilities. This vulnerability demonstrates how attackers can hijack AI agents through web-based attacks, turning trusted AI systems into persistent attack vectors that operate with legitimate credentials and permissions.
Attack Path Analysis
Attacker leverages DNS rebinding to exploit NVIDIA NemoClaw's misconfigured Ollama binding (0.0.0.0:11434) through a malicious webpage, bypassing CORS and Host header validation to poison the AI model's chat template with persistent hidden instructions that survive across all future conversations and agent interactions.
Kill Chain Progression
Initial Compromise
Description
Malicious webpage exploits DNS rebinding against NemoClaw's Ollama instance bound to 0.0.0.0:11434, bypassing CORS and Host header validation to gain unauthenticated API access
Related CVEs
CVE-2024-28224
CVSS 6.6DNS rebinding vulnerability in Ollama allows remote attackers to bypass host validation and execute unauthorized API calls when bound to non-loopback addresses.
Affected Products:
Ollama Ollama – < 0.1.29
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Drive-by Compromise
Exploit Public-Facing Application
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Data Manipulation: Stored Data Manipulation
Remote Services: Remote Desktop Protocol
Indicator Removal on Host: File Deletion
Abuse Elevation Control Mechanism: Bypass User Account Control
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Micro-segmentation and Network Access Control
Control ID: Network and Environment - Advanced
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
Digital Operational Resilience Act (DORA) – Identification and Classification of Information and Communication Technology Risk
Control ID: Article 8
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
PCI DSS 4.0 – Configuration Standards for Network Security Controls
Control ID: 1.2.1
ISO 27001:2022 – Configuration Management
Control ID: A.8.9
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI/ML model poisoning via NVIDIA NemoClaw vulnerability exposes software development environments to malicious webpage attacks, compromising local AI agents and embedded instructions.
Information Technology/IT
DNS rebinding attacks against Ollama instances bypass authentication controls, enabling remote manipulation of AI model templates and persistent compromise of enterprise AI systems.
Computer/Network Security
Security professionals face elevated risks from chat template poisoning techniques that persist across conversations, undermining AI-assisted threat detection and incident response capabilities.
Health Care / Life Sciences
HIPAA compliance frameworks threatened by AI model manipulation vulnerabilities, potentially compromising patient data protection through poisoned healthcare AI agent interactions and recommendations.
Sources
- A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClawhttps://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.htmlVerified
- Technical Advisory: Ollama DNS Rebinding Attack CVE-2024-28224https://www.nccgroup.com/research/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/Verified
- NVIDIA NemoClaw Documentation - Set up Ollamahttps://docs.nvidia.com/nemoclaw/user-guide/openclaw/inference/local-inference/set-up-ollamaVerified
- Ollama NemoClaw Integration Documentationhttps://docs.ollama.com/integrations/nemoclawVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF would have significantly constrained this DNS rebinding attack against NemoClaw's Ollama instance by limiting network reachability and segmenting AI workloads from external access vectors. The attack's blast radius would likely be reduced through workload isolation and controlled east-west traffic flows.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network segmentation would likely have restricted external web traffic from reaching the Ollama AI service, reducing the attack surface available for DNS rebinding exploitation attempts
Control: Zero Trust Segmentation
Mitigation: Identity-aware access controls would likely have constrained the AI agent's inherited privileges and limited its scope of access to connected resources and services
Control: East-West Traffic Security
Mitigation: Microsegmentation policies would likely have limited the compromised AI agent's ability to traverse between workloads and constrained its access to sensitive internal resources
Control: Multicloud Visibility & Control
Mitigation: Network monitoring and traffic analysis would likely have detected anomalous communication patterns between the AI service and external command infrastructure, reducing covert channel effectiveness
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely have limited the AI agent's ability to transmit sensitive data to unauthorized external destinations, constraining data exfiltration pathways
While model poisoning would likely persist within the compromised AI service, the overall business impact would be constrained due to limited network access and reduced blast radius
Impact at a Glance
Affected Business Functions
- AI/ML Development Operations
- Local Model Inference Services
- Agent-Based Automation
- Secure Development Environments
Estimated downtime: 1 days
Estimated loss: N/A
Potential compromise of AI model chat templates allowing persistent injection of malicious instructions across all future conversations. No direct data exfiltration but model behavior manipulation could affect decision-making processes and agent actions within sandboxed environments.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to isolate AI model endpoints and prevent unauthorized network access to local inference services
- • Deploy egress security policies to control AI agent outbound communications and prevent data exfiltration through model interactions
- • Enable multicloud visibility and control to monitor anomalous AI agent behaviors and detect template poisoning attempts
- • Establish inline IPS capabilities to detect and block DNS rebinding attacks and malicious web-to-localhost communication patterns
- • Implement Cloud Native Security Fabric controls to provide real-time inspection and policy enforcement for AI/ML workloads and shadow AI detection
