NVIDIA NemoClaw and OpenShell — 18-CVE August bulletin: two CVSS 9.9 OpenShell sandbox escapes, and a web page that hijacks the agent's local Ollama backend via DNS rebinding (CVE-2026-65105)

TL;DR

NemoClaw is NVIDIA's tool for running the OpenClaw agent inside OpenShell sandboxes on a developer's own GPU box. On 2026-08-25 NVIDIA published one bulletin with 18 CVEs across the two: two CVSS 9.9 OpenShell sandbox escapes (CVE-2026-65093, CVE-2026-65083), six OS-command-injection bugs in NemoClaw's CLI, Telegram bridge, NIM management and status/logs plugins, unverified code download in the installer, and CVE-2026-65105 (CVSS 8.1) — the one with a story. Cyera and Oasis Security showed that NemoClaw binds the local Ollama inference server to 0.0.0.0:11434 while telling the user "localhost"; Ollama skips its Host-header check when not bound to loopback; so one visit to an attacker's web page (DNS rebinding) gives the page full unauthenticated Ollama API access — enough to poison the model's template so every later answer carries the attacker's instructions, invisibly, persistently. Fix: OpenShell 0.0.34; NemoClaw 0.0.25 and earlier affected, fixes per CVE via the GitHub repo. Nothing exploited in the wild has been reported.

What happened

The bulletin. NVIDIA Security Bulletin 5872, "NVIDIA NemoClaw and OpenShell – August 2026," published 2026-08-25 and mirrored as Markdown and CSAF JSON in NVIDIA's product-security GitHub repository, lists NemoClaw 0–0.0.25 (Linux) and OpenShell 0–0.0.33 (all platforms) as affected, with OpenShell v0.0.34 as the fix and NemoClaw fixes tracked per CVE. NVIDIA says the issues "were found externally" and credits, among others, Markus Halvorsen, Leo Lin, yongzhi, Eran Shimony (Palo Alto Networks) and Oasis Security. The eighteen, as listed on the bulletin:

Two things in that table matter beyond NemoClaw. OpenShell is the sandbox — the containment boundary NVIDIA sells as the reason it is safe to let an OpenClaw agent run with tools — and the two most severe bugs are in it: a straight escape and an "incomplete list of disallowed inputs" in the API that provisions sandboxes. "Sandbox" here joins Pyodide, vm2/isolated-vm, DeepSeek Harness and the Cursor batches on this repo's list of isolation layers that shipped an escape in 2026. And CVE-2026-65081 is install-time: the NemoClaw installer executes untrusted code, which is the first thing a developer runs.

The drive-by (CVE-2026-65105). Cyera's Elad Luz and Ofek Itach, working with Oasis Security, published "Drive-By Agent Hijacking" on 2026-08-25, the same day as the bulletin. NemoClaw supports several inference backends, one of them a local Ollama. To make Ollama reachable from inside the OpenShell container, NemoClaw starts it bound to 0.0.0.0:11434 — while the UI prints "Using Ollama on localhost:11434." Ollama's own defence against browser-originated requests is a Host-header check, and per Cyera "when Ollama is bound to a non-loopback address (such as 0.0.0.0), the Host header validation is skipped entirely." From there it is textbook DNS rebinding: JavaScript on the attacker's page makes its own hostname resolve to 127.0.0.1 after the first load, and the victim's browser now issues same-origin requests to the developer's Ollama with no credentials required. What the page can then do: run inference on the victim's GPU, enumerate models, system prompts and hostnames, delete models or fill the disk — and, the finding that makes this an agent advisory rather than an Ollama one, create a poisoned model via /api/create whose template is applied at inference time to every message, including the client's own system prompt. Cyera: template injection "is invisible to the user," and beats system-prompt injection because the template wraps everything. An OpenClaw agent running on that backend has just been given a persistent, silent, attacker-written instruction layer. NVD carries the CVE at CVSS 8.1 with AV:A (adjacent) and CWE-306; the browser-as-bridge is what turns "adjacent" into "any web page."

Cyera says patches were available at publication but does not name NemoClaw version numbers, and the NemoClaw GitHub repository publishes no releases page — the bulletin's own guidance is to update from the NVIDIA/NemoClaw and NVIDIA/OpenShell repositories.

Am I affected?

Affected if you installed NemoClaw ≤ 0.0.25 or OpenShell ≤ 0.0.33, and — for CVE-2026-65105 — if you use the Ollama backend and browse the web from the same machine or network while it runs.

# Versions
nemoclaw --version 2>/dev/null; openshell --version 2>/dev/null
# The tell for CVE-2026-65105: Ollama listening on all interfaces, not loopback
ss -tlnp | grep ':11434'          # 0.0.0.0:11434 or *:11434 = exposed; 127.0.0.1:11434 = not
# Poisoned-model check: anything you didn't create, or a template you don't recognize
ollama list
ollama show <model> --template
# Install-time code (CVE-2026-65081, CVE-2026-65097): what did the installer fetch and run?
grep -rE 'curl|wget' ~/.nemoclaw 2>/dev/null | head

If Ollama was listening on 0.0.0.0 on a workstation that browses the web, treat every model on it as untrusted until you have inspected its template and Modelfile — a poisoned template shows up as a model that works normally while quietly steering the agent.

If you are affected

1. Update OpenShell to 0.0.34+ and NemoClaw to the current repository state; then confirm Ollama binds 127.0.0.1 (or set OLLAMA_HOST=127.0.0.1 and reach it from the container over a bridge you control).
2. Delete and re-pull any model whose template or Modelfile you cannot account for; do not "clean" a template by hand.
3. The agent's environment is the blast radius: playbooks/if-your-local-ai-agent-was-exploited.md, then playbooks/rotating-cloud-credentials.md for anything the OpenClaw agent held.

Prevention

• prevention/agent-sandboxing.md — the sandbox is software too; keep the agent's credentials and network reach small enough that a sandbox escape is a bad day, not a breach.
• prevention/mcp-hygiene.md — a local inference server is a local network service; the same "bound to 0.0.0.0 with no auth" audit this repo runs on MCP servers applies to 11434.
• A request header is not an authentication factor. Ollama's Host check, Starlette BadHost, DeepSeek Harness, and Ray all failed the same way: the client chose the string. Bind loopback, and authenticate anything a browser could reach.

Sources

• NVIDIA product-security — Security Bulletin 5872: NVIDIA NemoClaw and OpenShell – August 2026 (Markdown mirror) — fetched 2026-09-13 (bulletin text via the repository's raw 5872.md); primary: all 18 CVEs with CVSS, CWE and impact, affected ranges, OpenShell 0.0.34 fix, acknowledgements, "found externally."
• Cyera Research — Drive-By Agent Hijacking: one website visit to hijack your AI agent — fetched 2026-09-13; published 2026-08-25 (Elad Luz, Ofek Itach, with Oasis Security): the 0.0.0.0:11434 binding, Ollama's skipped Host check on non-loopback binds, the DNS-rebinding chain, /api/create template poisoning and why it beats system-prompt injection.
• NVD — CVE-2026-65105 — fetched via the NVD API 2026-09-13; published 2026-08-25, CVSS 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) from psirt@nvidia.com, CWE-306, NemoClaw 0–0.0.25.
• Forkast — Four Weeks, Four Critical CVEs: AI Inference Infrastructure Is Now a Regular Target — fetched 2026-09-13; published 2026-09-11: places CVE-2026-65105 in the August–September run of agent-runtime disclosures alongside DeepSeek Harness and Langflow; credits Oasis and Cyera.
• NVIDIA/NemoClaw — releases — fetched 2026-09-13; confirms the repository publishes no tagged releases, so there is no NemoClaw version number to cite as "fixed."