NemoClaw lets a visited web page poison the model template behind a developer's agent

What happened

NVIDIA disclosed a missing-authentication flaw in NemoClaw, which it rates 8.1, high severity. The deployment wrapper binds the bundled Ollama server to 0.0.0.0:11434 so a container can reach it, which switches off Ollama's Host-header check, and a page the developer visits can then use DNS rebinding to hold unauthenticated access to that local server. The researchers read the running model's Go template with the show endpoint, wrote instructions into it, and put it back with the create endpoint.

The template renders between the client's messages and inference, so the added instructions are appended to every system-message render, survive a client-supplied system prompt, persist across sessions and stay invisible to anything reading the API. NVIDIA lists NemoClaw for Linux up to 0.0.25 as affected and gives commit f06796ff3 as the fix, prints the same 0.0.25 as both the top of the affected range and the fixed version, and credits Markus Halvorsen and Elad Luz of Oasis Security; the research writeup names Elad Luz and Ofek Itach. The bulletin carries sixteen CVEs across NemoClaw and OpenShell and claims no exploitation.