FuriaHubNemoClaw flaw let a malicious site poison a developer’s local Ollama model
Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.
On August 25, 2026 SiliconANGLE reported that a NemoClaw flaw could let attackers poison the model behind a developer’s AI agent.
What we know
- Oasis Security disclosed CVE-2026-65105: one visit to a malicious site can control the local Ollama instance behind the NemoClaw agent.
- Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.
- DNS rebinding can bypass the origin allowlist.
- Model poisoning through the /api/create template persists across chats.
- Oasis reported the issue to Nvidia PSIRT first.
Takeaways
- A browsing tab can reach the local Ollama port behind NemoClaw.
- The Host check does not apply when the service is bound off loopback.
- A poisoned model template survives later conversations.
Source: SiliconANGLE
