NVIDIA patches NemoClaw CVE-2026-65105 after model-poisoning disclosure

NVIDIA published a High-severity security update for NemoClaw on August 25, 2026, after researchers described a browser-based route to an exposed local inference service. The official bulletin assigns CVE-2026-65105 a CVSS score of 8.1 and says unauthenticated service access can lead to information disclosure and denial of service. Researchers at Oasis Security, now part of Cyera, went further: they demonstrated how DNS rebinding and template injection could alter a local model's behaviour persistently.

The practical lesson is narrower than the most alarming headline and more important than a routine patch notice. A local AI agent stack can cross several trust boundaries at once: browser, loopback service, model runtime, model template, tools and persistent memory. Security teams need to patch the affected software, but they also need controls that reveal which model configuration ran, what changed and which actions followed.

What NVIDIA's bulletin confirms

NVIDIA's security bulletin lists CVE-2026-65105 for NemoClaw on Linux. It describes improper access control in the inference setup, says the issue can be exploited through unauthenticated service access and records information disclosure and denial of service as potential impacts.

There is an important versioning detail. The bulletin identifies security update commit f06796ff3 and version 0.0.25, while its affected-version field also reads 0 to 0.0.25. Operators should therefore verify the exact patched commit from the current NVIDIA source rather than relying on the version string alone. This is a case where update evidence should include a commit or artifact digest, not only a package label.

The bulletin covers several NemoClaw issues. CVE-2026-65105 is the one tied to unauthenticated inference-service access. Keeping that scope clear prevents other findings in the same advisory from being blended into this incident.

What the researchers demonstrated

Oasis Security's technical report says NemoClaw's setup exposed Ollama on 0.0.0.0:11434, making it reachable beyond loopback. The researchers combined that exposure with DNS rebinding. In their proof of concept, a user visiting a malicious website gave browser code a path to the local service after DNS resolution changed.

The report then describes modifying a model template so that injected instructions remained active in later sessions. That persistence is why the finding is often described as model poisoning. It is a researcher-demonstrated attack path, not an impact that NVIDIA names in the bulletin. The Hacker News and CSO independently covered the demonstration. Their reporting also said no exploitation in the wild had been identified at publication time.

Those distinctions matter. NVIDIA confirmed an access-control vulnerability and its narrower impact categories. Oasis reported a repeatable browser-to-runtime chain and persistent instruction modification. Public evidence did not establish a real-world compromise campaign.

The governance consequence is configuration integrity

Agent assurance often concentrates on prompts submitted by users. This incident shows why the model-serving layer and its templates belong in the same control boundary. A changed template can affect every later interaction while leaving the visible application prompt untouched.

Teams running local or self-hosted agents should be able to answer five questions:

1. Which inference endpoints were listening, and on which interfaces?
2. Which model, template, system instruction and tool policy were active for a session?
3. Who or what changed those artifacts, and through which approved path?
4. Did the agent's subsequent outputs or tool calls depart from its baseline?
5. Can investigators reproduce the effective configuration from signed evidence?

That evidence is part of AI agent monitoring, not merely infrastructure logging. It should connect runtime configuration to the agent's identity, permissions, inputs, outputs and actions.

Immediate controls for NemoClaw operators

First, apply the NVIDIA update and record the exact commit or artifact digest. Confirm that the inference service is bound only to the interface required by the deployment. A local service should not become network-accessible because of a permissive default.

Second, restrict browser-origin access and test DNS-rebinding defenses. Network controls should treat loopback and private services as sensitive destinations, even when the initial request originates from a trusted browser.

Third, make model templates and system instructions immutable outside an approved deployment process. Store hashes, require review for changes and alert on drift. A template edit should carry the same evidence expectations as a policy or production-code change.

Fourth, rotate credentials or tokens that may have been exposed and review agent activity for unusual configuration changes, outbound connections and tool use. Absence of a public exploitation report is not proof that a specific environment was unaffected.

Finally, test the complete chain. Prompt-injection controls should cover untrusted web content, local service access, model configuration and downstream actions. A control that filters only the chat input leaves the rest of the path unexamined.

Maetra analysis

CVE-2026-65105 is a useful control-design test because the technical vulnerability and the governance failure are closely linked. Patch status answers whether a known access-control defect is addressed. It does not prove that inference endpoints are correctly scoped, model templates are intact or agent actions remained within policy.

The durable response is to bind those facts into one evidence trail: approved artifact, runtime configuration, agent identity, tool permissions and observed actions. That makes a browser-to-model attack detectable as a sequence of control failures instead of an isolated anomaly.

Sources

• NVIDIA, Security Bulletin: NVIDIA NemoClaw Security Updates for Multiple Vulnerabilities, August 25, 2026
• Oasis Security and Cyera, One Website Visit to Hijack Your AI Agent, August 25, 2026
• The Hacker News, A Malicious Webpage Could Poison Your Local NemoClaw AI Agent, August 25, 2026
• CSO, NemoClaw AI can be poisoned through a browser tab, August 25, 2026