On August 25, 2026, Oasis Security researchers — publishing through Cyera — detailed a high-severity flaw in NVIDIA NemoClaw that turns a routine local-inference setup choice into a browser-reachable path to the host model server. Tracked as CVE-2026-65105 (CVSS 3.1 base score 8.1), the issue lets an adjacent-network or drive-by browser attacker reach an unauthenticated Ollama API that NemoClaw exposes for containerized OpenShell sandboxes.
The practical punchline is not a sandbox breakout. OpenShell still constrains the agent process. The attack hijacks the inference backend the agent trusts, including a persistent rewrite of the model chat template that survives the agent's own system prompts. NVIDIA credited Markus Halvorsen and Elad Luz of Oasis Security in its August 2026 NemoClaw and OpenShell product-security bulletin and published fixes for the affected NemoClaw Linux builds.
Confirmed
- CVE-2026-65105 is listed by NVIDIA as missing authentication in NemoClaw's Linux inference-server setup (CWE-306), with impacts framed as information disclosure and denial of service in the vendor CVSS vector. Oasis/Cyera additionally demonstrate silent chat-template poisoning once API access is obtained.
- NemoClaw starts host Ollama with OLLAMA_HOST=0.0.0.0:11434 so Docker sandboxes can reach local inference. That non-loopback bind causes Ollama to skip Host-header validation that was meant to block browser-origin attacks; CORS alone remains, and DNS rebinding can satisfy it.
- Oasis/Cyera show that a visit to an attacker-controlled page on port 11434 can then call Ollama endpoints without credentials — including /api/show and /api/create — and splice hidden instructions into the model's Go chat template so every later system message carries attacker text.
- NVIDIA's August 2026 bulletin (product-security advisory 5872) addresses CVE-2026-65105 on Linux for NemoClaw versions 0 through 0.0.25, pointing operators to updated GitHub builds, and credits the Oasis researchers. The same bulletin also ships multiple OpenShell fixes, including critical sandbox-escape and provisioning issues rated up to 9.9 (for example CVE-2026-65093 and CVE-2026-65083).
- As of the Cyera disclosure, researchers stated they had not seen confirmed real-world exploitation of this chain.
What's going on
NemoClaw is NVIDIA's reference stack for running OpenClaw-style always-on agents inside OpenShell sandboxes, with managed inference and credentials kept outside the sandbox for supported paths. Local Ollama is one backend option for keeping prompts on the developer machine. Containers cannot reach a loopback-only Ollama, so the installer widens the bind. Installer messaging that still says the service is on localhost:11434 can understate that the socket is listening on every interface.
Once the API is reachable, template injection beats a simple model-level system field: OpenClaw supplies its own system prompt at request time and would override a poisoned system field, but the template renders messages after the client payload arrives. The client cannot inspect or override that template. LAN neighbors can also hit the open port directly without rebinding.
Sibling Brocker coverage of NVIDIA's agent-security framing — harness versus runtime — is in NVIDIA Draws a Security Line for AI Agents: Harness Guides, Runtime Decides.
Unknown
- How many NemoClaw installs still run pre-fix Linux builds, or Windows/WSL paths that researchers said lagged structural loopback enforcement at disclosure, is not quantified in public reporting.
- Whether template poisoning has appeared in the wild against OpenClaw/NemoClaw users remains unconfirmed; disclosure-time reporting found no confirmed exploitation.
- NVIDIA's CVSS text for CVE-2026-65105 emphasizes disclosure and denial of service; the Oasis/Cyera integrity impact via template rewrite is a research demonstration on top of the unauthenticated API, not a separate CVE ID in the bulletin table.
Our take
This is the predictable failure mode of "secure the agent container, leave the host model API wide open." OpenShell can be doing its job while the brain the agent queries is rewritten from a webpage. Agent security that stops at the sandbox boundary — and treats local inference as a private loopback service by wishful labeling — will keep producing these CVEs as claws gain repo, MCP, and messaging scope.
