A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
Summary
NVIDIA NemoClaw has a vulnerability where a malicious webpage can take control of a local Ollama instance (the AI model server) and inject hidden instructions into the model by exploiting how the software binds the Ollama API to all network interfaces instead of just the local machine. An attacker can use DNS rebinding (making a domain resolve to the local machine) to bypass security checks and modify the model's template, causing poisoned instructions to affect every future conversation. NemoClaw v0.0.35 fixed the issue on macOS and Linux, but Windows and WSL (Windows Subsystem for Linux) versions remain vulnerable.
Solution / Mitigation
NemoClaw v0.0.35 fixed the issue on macOS and Linux. For Windows and WSL, v0.0.34 added a Windows installation with a warning instead. Additionally, the source notes that validating the Host header on the server side to allow only a set of authorized values is the standard fix for this class of attack, and Ollama introduced such validation in response to CVE-2024-28224, though it is currently skipped whenever Ollama is bound to a non-loopback address.
Classification
Affected Vendors
Related Issues
CVE-2024-37052: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling
CVE-2026-47482: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory
Original source: https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
First tracked: August 25, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 92%