Threat Overview
CVE-2026-65105 affects NVIDIA NemoClaw deployments that use Ollama for local model inference. Cyera’s Oasis Security research found that NemoClaw could expose the local Ollama API on 0.0.0.0:11434 and weaken browser-origin protections, enabling a malicious website to reach the local model server through DNS rebinding without authentication.
A successful attack can modify the model’s chat template and implant persistent instructions that influence future agent conversations. Public reporting stated that the affected research branch was fixed for macOS and Linux in v0.0.35, while Windows did not have an equivalent fix at disclosure; current NVIDIA documentation should be used to validate the appropriate supported build.
References
Impacted Systems
| Vendor / Product | NVIDIA NemoClaw with OpenClaw and Ollama local inference |
| CVE | CVE-2026-65105 |
| Exposed service | Ollama HTTP API, commonly port 11434 |
| Vulnerable condition | Ollama bound beyond loopback with insufficient browser-origin protection |
| Attack prerequisite | Victim visits an attacker-controlled web page from a browser that can reach the local API |
| Potential impact | Unauthenticated model enumeration/modification/deletion and persistent chat-template poisoning |
| Exposure of greatest concern | AI-agent workstations where agents have access to organizational tools, APIs, code, or sensitive data |
What this hunt looks for
Looks for browser-to-Ollama traffic on TCP 11434, NemoClaw or Ollama processes using or exposing that service, and related endpoint process activity that can indicate a browser reaching a local model API.
Required logs
DeviceNetworkEvents and DeviceProcessEvents from endpoints running or accessing NemoClaw/Ollama.
First-Pass — Browser Connections to Ollama Port 11434
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemotePort == 11434
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated ascFollow-Up — Ollama / NemoClaw Network Exposure
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where LocalPort == 11434 or RemotePort == 11434
| where InitiatingProcessFileName has_any ("ollama","nemoclaw","openclaw") or InitiatingProcessCommandLine has_any ("ollama","nemoclaw","openclaw","11434")
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP,20), RemoteUrls=make_set(RemoteUrl,20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalPort
| sort by Connections descFollow-Up — NemoClaw / Ollama Process Discovery
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName has_any ("ollama","nemoclaw","openclaw") or ProcessCommandLine has_any ("ollama","nemoclaw","openclaw","11434")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by TimeGenerated asc
Killian Sherer 