Executive Summary
A critical vulnerability chain involving NVIDIA NemoClaw and the Ollama inference engine allows attacker-controlled webpages to take control of local AI instances. By exploiting DNS rebinding (CVE-2024-28224), a malicious site can bypass browser Same-Origin Policy to interact with the Ollama API, which NemoClaw frequently binds to 0.0.0.0 (all interfaces) without authentication.
Technically, attackers can modify a model's chat template to inject persistent, hidden instructions into every conversation, effectively poisoning the AI's behavior. Additionally, the vulnerability allows for the exfiltration of sensitive local files by creating a malicious model that points to local paths via the ADAPTER instruction and pushing it to a rogue registry.
While patches exist for Linux and macOS (NemoClaw v0.0.35+ and Ollama v0.1.29+), researchers indicate that Windows and WSL configurations remain at risk due to specific architectural requirements that necessitate non-loopback bindings, bypassing existing host-header validations.
Key Details
Threat Name
NVIDIA NemoClaw Model Poisoning
Affects
Ollama v0.1.28 and earlier, Ollama (versions prior to v0.1.29)
Adversary
—
MITRE Techniques
Malware/Tools
NemoClaw, OpenClaw, Singularity of Origin