The issue begins with networking. As a result of the OpenShell sandbox runs inside a Docker container, it can not attain an Ollama service listening solely on the loopback deal with, 127.0.0.1. NemoClaw subsequently begins Ollama with “OLLAMA_HOST=0.0.0.0:11434,” making it pay attention on all community interfaces.
That solves the container connectivity downside but additionally disables an vital Ollama safety. Ollama’s API doesn’t require authentication and usually makes use of CORS and Host-header checks to stop unauthorized browser entry. However when Ollama is sure to a non-loopback deal with, its Host-header validation is skipped.
An attacker can then use DNS rebinding to make a malicious webpage initially resolve to the attacker’s server and subsequently resolve to 127.0.0.1 or a neighborhood community deal with. The browser would nonetheless contemplate the requests to belong to the attacker-controlled hostname, however Ollama would obtain them, leading to unauthenticated entry to the native API.
