NVIDIA NemoClaw Binds Ollama to 0.0.0.0, Enabling Model Poisoning via DNS Rebinding

Oasis Security demonstrated the chain on macOS with Firefox: a malicious page uses DNS rebinding to reach the unauthenticated /api/create endpoint after Host-header checks are bypassed on non-loopback binds. The poisoned template appends attacker text to every system message at inference time, surviving agent restarts and tool use. This matches the exact configuration Ollama documentation recommends for container and WSL2 setups. The 2024 Ollama advisory CVE-2024-28224 documented the same DNS-rebinding vector and led to Host validation, yet the fix is explicitly skipped when OLLAMA_HOST is set to 0.0.0.0. NemoClaw's platform-specific paths reintroduce the exposure on Windows while macOS and Linux received the v0.0.35 proxy fix. No independent confirmation of active exploitation exists. Local agent stacks continue to trade sandbox isolation for convenience by exposing inference APIs to host network namespaces. Procurement and reference implementations repeatedly favor reachability over strict loopback or token gating, creating a repeatable pattern visible in Docker Desktop, WSL2, and multiple agent frameworks. NVIDIA has not published a Windows remediation timeline. Organizations running NemoClaw on WSL or native Windows should isolate the host or pin Ollama to 127.0.0.1 and route through an authenticated proxy until a patch ships.