NemoClaw operating chain exposes Olama to unauthenticated access and alters chat templates

What has happened (confirmed facts): Oasis Security researchers have published a report describing a chain of exploitation against the NemoClaw configuration that can allow a web page controlled by an attacker to access without authentication a local instance of Olama and modify the model's "chat template" to insert hidden instructions that persist in subsequent conversations. Oasis Security states that it reported the problem to the NVIDIA PSIRT team prior to publication; there is, according to the report, no CVE identifier, neither a range of affected versions nor a parcheed version indicated by Oasis. No field exploitation has been reported until 25 August 2026.

How the attack chain works technically (technical explanation): The vector takes advantage of two concrete facts: first, that NemoClaw can start Olama with OLLAMA _ HOST = 0.0.0: 11434, which makes the inference service listen on all interfaces rather than only on loopback; second, that the API in port 11434 does not require authentication and its protection from web origins depends on host / origin checks and a tokenized proxy that, in some settings (especially routes using WSL / Docker Desktop on Windows), is not present or not applied.

With the API displayed in this way, an attacker can serve a website that first responds from its legitimate domain and then, by means of a technique ofDNS refusing, makes that domain solve at 127.0.0.1. The browser maintains the same source policy (same-origin) and, if the server does not properly value the Host or Origin, the browser will send requests that the Olama API will accept as if they were from the same source. From there the request to/ api / createyou can write a Go template that modifies how structured messages are rendezvous; the malicious template can add text to each system message in inference time, and this change is stored at model level, invisible to later customers who use the API.

What has been confirmed in the software: Public reviews of the NemoClaw repository show that the August version added a check (v0.0.106) that prevents the local proxy from starting if it detects that the backend Olama is linked to a non-loopback interface - but this prevention does not cover all the execution routes. In particular, the Windows-host / Wsl / Docker Desktop route used to access daemon from containers usually sets OLLAMA _ HOST = 0.0.0.0 to allow that accessibility, and NemoClaw does not start the proxy on those roads. In addition, no validation of the integrity of the chat template has been found in the repository to prevent remote modifications of the template.

Practical implications: If the chain is played on a target machine, a simple malicious website opened in the local user's browser could take control of the Olama agent serving OpenClaw / OpenShell / NemoClaw. The consequences include: persistence of malicious instructions in model behavior (handling future responses), indirect execution of tools that the agent has connected (e.g. calls to local executables or third party APIs), exfiltration of local data and the creation of "abducted" agents acting as pivot within the operator's environment. The operation does not require the API to be accessible from the external network: it is enough for the local user's browser to reach 11434 port at localhost.

What is confirmed and what is uncertain: Confirmed: the existence of the method (binding to 0.0.0.0 + lack of authentication + DNS rerendering) and that NemoClaw presents boot roads that leave the daemon accessible at 0.0.0.0 on certain platforms; also confirmed that a template modification can persist at model level. Uncertain / estimated: which browsers and specific versions are susceptible in practice (the report does not specify against which browsers / OS the chain was verified), and whether there is active exploitation in real environments beyond laboratory tests. There is also no public list of affected versions or an official patch indicated by Oasis in its initial notice.

Specific and verifiable measures to be implemented by operators(ordered by ease and impact):

1) Check if your local Olama instance is listening at 0.0.0.0 and, if so, change it to loopback. In Linux systems use, for example:ss -ltnp-124; grep 11434ornetstat -plntand check the column "Local Address." If 0.0.0: 11434 appears, reconfigure the service unit to exportOLLAMA _ HOST = 127.0.0.1: 11434and restart the service.

2) Block access to 11434 from non-loopback network interfaces with firewall rules (e.g. iptables / nftables or Windows Firewall rules) to prevent LAN or Internet connections. This mitigates accidental exposures even if the environment variable is not corrected immediately.

3) Review the Docker Desktop / WSL2 configuration on Windows: do not allow containers or WSL to access the daemon in the host via host.docker.internal or by public binding if not strictly necessary. In environments where such connectivity is essential, apply additional controls (local firewall, revoke access to critical tools, run the agent in isolated VM).

4) Limit the ability of the agent: reduce or disable the tools and call capabilities to APIs / executable that the agent may invoke. Treat models and their environments as components that can be compromised; do not trust the sandbox's isolation to protect secrets or access critical infrastructure.

5) Check templates and models after suspicion: see the Administrative API (/ api / showor other documented administrative routes) to detect changes in templates and model context. If you detect unexpected templates, restore from a secure copy or retrain / reimplement the model and rotate credentials / keys that the agent could use.

6) Updating and following the supplier's publications: although Oasis Security notified NVIDIA, the absence of a CVE or a clear patch requires operators to follow both the NemoClaw repository and the Olama notes and to apply patches or configuration changes recommended by the responsible teams. See Olama's official documentation on safe configuration and protection against DNS reclining: https: / / ollama.com / docs. To understand the technical threat of DNS reclining and how to mitigate it in web applications, see OWASP documentation: https: / / owasp.org / www-community / attacks / DNS _ Rebinding.

Recommendations for end-users and developers: Users: do not open unknown or unreliable pages on machines where local agents are developed or run; close unnecessary tabs and avoid running browsers with high privileges. Developers / operators: require authentication in the Inference API, validate the host header on the server (allow only authorized values) and add integrity controls on model chat and metadata templates to ensure that administrative modifications are recorded and reviewable. Host / Origin validations and the implementation of tokenization / proxy should work on all deployment routes, including WSL and Docker Desktop environments.

Additional context and reading: The technique of "planting" instructions handling prompt rendering templates has previously been documented in other agent projects. In addition, the classic mitigation for DNS reclining attacks is to check the host on the server and restrict binding to loopback, measures that have already been recommended in previous Olama-related notices.

In short, there is a plausible and documented chain for a local browser, using DNS reclining and an Oflame API linked to 0.0.0.0 without authentication, to modify chat templates and to alter an agent's persistent behavior. Act on setting up binding, apply firewall rules and limit agent capabilities reduces the risk of operation until there is a patch and official indications covering all deployment routes.