NVIDIA NemoClaw vulnerability allows hijacking of local AI models

Researchers at Oasis Security have identified a security flaw in NVIDIA NemoClaw that could allow an attacker-controlled webpage to gain unauthenticated control over a local model server. The vulnerability specifically affects NemoClaw deployments that use Ollama for local inference.

The issue stems from how NemoClaw configures the Ollama service. On certain platforms, such as Windows and WSL, the service is bound to all network interfaces rather than being restricted to the loopback address. This configuration disables Ollama’s host header validation and leaves its CORS checks as the only defense. Researchers demonstrated that these checks could be bypassed using DNS rebinding, allowing a remote webpage to interact with the local API.

An attacker with API access could perform several malicious actions, including running arbitrary inference on the victim’s GPU, enumerating installed models, extracting system prompts, deleting models, or modifying chat templates to plant hidden instructions. Additionally, the binding exposes the API to any device on the same local network segment without requiring user interaction.

NVIDIA has addressed the issue in NemoClaw version 0.0.35 for macOS and Linux. However, as of the report, a fix for the Windows and WSL paths was not yet available, though version 0.0.34 included a warning for Windows installations.