---
id: 2026-08-nvidia-nemoclaw-openshell-cve-batch
title: "NVIDIA NemoClaw and OpenShell — 18-CVE August bulletin: two CVSS 9.9 OpenShell sandbox escapes, and a web page that hijacks the agent's local Ollama backend via DNS rebinding (CVE-2026-65105)"
date_disclosed: 2026-08-25
last_updated: 2026-09-13
severity: critical
status: patched
ecosystems: [nvidia, openclaw, ollama, ai-agent-framework, agent-sandbox, python]
tools_affected: [nvidia-nemoclaw, nvidia-openshell, openclaw-on-nemoclaw, ollama-local-inference]
tags: [cve, sandbox-escape, dns-rebinding, host-header, missing-authentication, command-injection, model-poisoning, agent-runtime, vendor-bulletin, cwe-306, cwe-427, cwe-78]
---

## TL;DR

**NemoClaw** is NVIDIA's tool for running the [OpenClaw](2026-05-openclaw-claw-chain.md) agent inside **OpenShell** sandboxes on a developer's own GPU box. On **2026-08-25** NVIDIA published one bulletin with **18 CVEs** across the two: two **CVSS 9.9 OpenShell sandbox escapes** (**CVE-2026-65093**, **CVE-2026-65083**), six OS-command-injection bugs in NemoClaw's CLI, Telegram bridge, NIM management and status/logs plugins, unverified code download in the installer, and **CVE-2026-65105** (CVSS 8.1) — the one with a story. Cyera and Oasis Security showed that NemoClaw binds the local **Ollama** inference server to **`0.0.0.0:11434`** while telling the user "localhost"; Ollama **skips its `Host`-header check when not bound to loopback**; so **one visit to an attacker's web page** (DNS rebinding) gives the page full unauthenticated Ollama API access — enough to **poison the model's template so every later answer carries the attacker's instructions**, invisibly, persistently. Fix: **OpenShell 0.0.34**; NemoClaw 0.0.25 and earlier affected, fixes per CVE via the GitHub repo. Nothing exploited in the wild has been reported.

## What happened

**The bulletin.** NVIDIA Security Bulletin 5872, *"NVIDIA NemoClaw and OpenShell – August 2026,"* published 2026-08-25 and mirrored as Markdown and CSAF JSON in NVIDIA's `product-security` GitHub repository, lists **NemoClaw 0–0.0.25 (Linux)** and **OpenShell 0–0.0.33 (all platforms)** as affected, with **OpenShell v0.0.34** as the fix and NemoClaw fixes tracked per CVE. NVIDIA says the issues "were found externally" and credits, among others, Markus Halvorsen, Leo Lin, yongzhi, Eran Shimony (Palo Alto Networks) and Oasis Security. The eighteen, as listed on the bulletin:

| CVE | CVSS | Component | Bug (NVIDIA's wording) |
|---|---|---|---|
| **CVE-2026-65093** | **9.9** | OpenShell (Linux) | **Sandbox escape** (CWE-427) → code execution, privilege escalation |
| **CVE-2026-65083** | **9.9** | OpenShell sandbox API | **Incomplete list of disallowed inputs** (CWE-184) → code execution, privilege escalation |
| CVE-2026-65091 | 8.8 | OpenShell | OS command injection via a **malicious gateway** (CWE-78) |
| CVE-2026-65092 | 8.5 | OpenShell | **Path-traversal bypass of the L7 REST policy** (CWE-22) |
| **CVE-2026-65105** | 8.1 | NemoClaw | **Remote access to the inference service without authentication** (CWE-306) |
| CVE-2026-65098 | 8.1 | NemoClaw | Weak authentication in the remote-access workflow (CWE-1390) |
| CVE-2026-65084 | 8.1 | NemoClaw | Improper certificate validation in deployment (CWE-295) |
| CVE-2026-65081 | 8.1 | NemoClaw | **Execution of untrusted code during installation** (CWE-494) |
| CVE-2026-65099 | 7.8 | NemoClaw CLI | OS command injection (CWE-78) |
| CVE-2026-65096 | 7.8 | NemoClaw Telegram bridge | OS command injection (CWE-78) |
| CVE-2026-65090 | 7.8 | NemoClaw NIM management | OS command injection (CWE-78) |
| CVE-2026-65089 | 7.8 | NemoClaw status/logs plugins | OS command injection (CWE-78) |
| CVE-2026-65097 | 7.5 | NemoClaw scripts | Code download without integrity check (CWE-494) |
| CVE-2026-65082 | 7.0 | NemoClaw migration command | Code injection (CWE-94) |
| CVE-2026-65086 | 6.8 | OpenShell sandbox exec handler | OS command injection (CWE-78) |
| CVE-2026-65087 | 5.6 | NemoClaw | Insufficiently protected credentials (CWE-522) |
| CVE-2026-65088 | 5.5 | NemoClaw | Process invoked with visible sensitive info (CWE-214) |
| CVE-2026-65085 | 5.2 | OpenShell inference proxy | Improper encoding/escaping (CWE-116) |

Two things in that table matter beyond NemoClaw. **OpenShell is the sandbox** — the containment boundary NVIDIA sells as the reason it is safe to let an OpenClaw agent run with tools — and the two most severe bugs are in it: a straight escape and an "incomplete list of disallowed inputs" in the API that provisions sandboxes. "Sandbox" here joins [Pyodide](2026-08-pyodide-sandbox-escape-cluster.md), [vm2/isolated-vm](2026-08-vm2-isolated-vm-sandbox-escapes.md), [DeepSeek Harness](2026-09-deepseek-harness-host-header-sandbox-escape.md) and the [Cursor batches](2026-07-cursor-sandbox-escape-batch.md) on this repo's list of isolation layers that shipped an escape in 2026. And **CVE-2026-65081** is install-time: the NemoClaw installer executes untrusted code, which is the *first* thing a developer runs.

**The drive-by (CVE-2026-65105).** Cyera's Elad Luz and Ofek Itach, working with Oasis Security, published *"Drive-By Agent Hijacking"* on 2026-08-25, the same day as the bulletin. NemoClaw supports several inference backends, one of them a local Ollama. To make Ollama reachable from inside the OpenShell container, NemoClaw starts it bound to **`0.0.0.0:11434`** — while the UI prints *"Using Ollama on localhost:11434."* Ollama's own defence against browser-originated requests is a `Host`-header check, and per Cyera *"when Ollama is bound to a non-loopback address (such as 0.0.0.0), the Host header validation is skipped entirely."* From there it is textbook **DNS rebinding**: JavaScript on the attacker's page makes its own hostname resolve to `127.0.0.1` after the first load, and the victim's browser now issues same-origin requests to the developer's Ollama with no credentials required. What the page can then do: run inference on the victim's GPU, enumerate models, system prompts and hostnames, delete models or fill the disk — and, the finding that makes this an *agent* advisory rather than an Ollama one, **create a poisoned model via `/api/create` whose template is applied at inference time to every message**, including the client's own system prompt. Cyera: template injection "is invisible to the user," and beats system-prompt injection because the template wraps everything. An OpenClaw agent running on that backend has just been given a persistent, silent, attacker-written instruction layer. NVD carries the CVE at CVSS 8.1 with `AV:A` (adjacent) and CWE-306; the browser-as-bridge is what turns "adjacent" into "any web page."

Cyera says patches were available at publication but does not name NemoClaw version numbers, and the NemoClaw GitHub repository publishes no releases page — the bulletin's own guidance is to update from the `NVIDIA/NemoClaw` and `NVIDIA/OpenShell` repositories.

## Am I affected?

Affected if you installed NemoClaw ≤ 0.0.25 or OpenShell ≤ 0.0.33, and — for CVE-2026-65105 — if you use the Ollama backend and browse the web from the same machine or network while it runs.

```bash
# Versions
nemoclaw --version 2>/dev/null; openshell --version 2>/dev/null
# The tell for CVE-2026-65105: Ollama listening on all interfaces, not loopback
ss -tlnp | grep ':11434'          # 0.0.0.0:11434 or *:11434 = exposed; 127.0.0.1:11434 = not
# Poisoned-model check: anything you didn't create, or a template you don't recognize
ollama list
ollama show <model> --template
# Install-time code (CVE-2026-65081, CVE-2026-65097): what did the installer fetch and run?
grep -rE 'curl|wget' ~/.nemoclaw 2>/dev/null | head
```

If Ollama was listening on `0.0.0.0` on a workstation that browses the web, treat every model on it as untrusted until you have inspected its template and Modelfile — a poisoned template shows up as a model that *works normally* while quietly steering the agent.

## If you are affected

1. Update **OpenShell to 0.0.34+** and NemoClaw to the current repository state; then confirm Ollama binds `127.0.0.1` (or set `OLLAMA_HOST=127.0.0.1` and reach it from the container over a bridge you control).
2. Delete and re-pull any model whose template or Modelfile you cannot account for; do not "clean" a template by hand.
3. The agent's environment is the blast radius: [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md), then [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md) for anything the OpenClaw agent held.

## Prevention

- [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md) — the sandbox is software too; keep the agent's credentials and network reach small enough that a sandbox escape is a bad day, not a breach.
- [prevention/mcp-hygiene.md](../prevention/mcp-hygiene.md) — a local inference server is a local network service; the same "bound to `0.0.0.0` with no auth" audit this repo runs on MCP servers applies to `11434`.
- **A request header is not an authentication factor.** Ollama's `Host` check, [Starlette BadHost](2026-05-starlette-badhost-host-header-bypass.md), [DeepSeek Harness](2026-09-deepseek-harness-host-header-sandbox-escape.md), and [Ray](2026-08-ray-cve-2025-62593-kev.md) all failed the same way: the client chose the string. Bind loopback, and authenticate anything a browser could reach.

## Sources

- [NVIDIA product-security — Security Bulletin 5872: NVIDIA NemoClaw and OpenShell – August 2026 (Markdown mirror)](https://github.com/NVIDIA/product-security/tree/main/2026/5872) — fetched 2026-09-13 (bulletin text via the repository's raw `5872.md`); primary: all 18 CVEs with CVSS, CWE and impact, affected ranges, OpenShell 0.0.34 fix, acknowledgements, "found externally."
- [Cyera Research — Drive-By Agent Hijacking: one website visit to hijack your AI agent](https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent) — fetched 2026-09-13; published 2026-08-25 (Elad Luz, Ofek Itach, with Oasis Security): the `0.0.0.0:11434` binding, Ollama's skipped `Host` check on non-loopback binds, the DNS-rebinding chain, `/api/create` template poisoning and why it beats system-prompt injection.
- [NVD — CVE-2026-65105](https://nvd.nist.gov/vuln/detail/CVE-2026-65105) — fetched via the NVD API 2026-09-13; published 2026-08-25, CVSS 8.1 (`AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`) from `psirt@nvidia.com`, CWE-306, NemoClaw 0–0.0.25.
- [Forkast — Four Weeks, Four Critical CVEs: AI Inference Infrastructure Is Now a Regular Target](https://forkast.news/four-weeks-four-critical-cves-ai-inference-infrastructure-is-now-a-regular-target/) — fetched 2026-09-13; published 2026-09-11: places CVE-2026-65105 in the August–September run of agent-runtime disclosures alongside DeepSeek Harness and Langflow; credits Oasis and Cyera.
- [NVIDIA/NemoClaw — releases](https://github.com/NVIDIA/NemoClaw/releases) — fetched 2026-09-13; confirms the repository publishes no tagged releases, so there is no NemoClaw version number to cite as "fixed."