From 1bbf2bd35c69d1bb63005946cec4e4ed0464f7ed Mon Sep 17 00:00:00 2001 From: ColinM-sys Date: Tue, 14 Apr 2026 13:05:51 -0400 Subject: [PATCH 1/2] fix(security): warn when Ollama binds to 0.0.0.0 during onboard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NemoClaw's onboard flow starts Ollama with OLLAMA_HOST=0.0.0.0 so the Docker-based sandbox can reach the host via host.docker.internal. This silently exposes the unauthenticated Ollama API (port 11434) to the entire local network. On public WiFi, any adjacent device can enumerate models, send prompts, and consume GPU resources without authentication. The 0.0.0.0 binding is intentional (Docker requires it), but the user is never informed of the exposure. Ollama's lack of authentication is a known issue with multiple CVEs (CNVD-2025-04094, CVE-2024-37032, CVE-2024-39720 through CVE-2024-39722) and 175,000+ exposed servers found in internet-wide scans. Add a visible warning during onboard at both Ollama startup sites (existing install and brew install paths) so the user knows their inference API is network-accessible. The warning is suppressed on WSL where Ollama binds to 127.0.0.1 by default. This does not change the binding behavior — only informs the user. A future fix should add a firewall rule or Docker network bridge to restrict access to localhost + the container bridge. Signed-off-by: ColinM-sys --- src/lib/onboard.ts | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts index ce3c84b7299..10598116259 100644 --- a/src/lib/onboard.ts +++ b/src/lib/onboard.ts @@ -3343,6 +3343,14 @@ async function setupNim(gpu) { const ollamaEnv = isWsl() ? "" : `OLLAMA_HOST=0.0.0.0:${OLLAMA_PORT} `; run(`${ollamaEnv}ollama serve > /dev/null 2>&1 &`, { ignoreError: true }); sleep(2); + if (!isWsl()) { + console.log(""); + console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); + console.log(" This exposes the Ollama API to your local network (no auth required)."); + console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); + console.log(" See: CNVD-2025-04094, CVE-2024-37032"); + console.log(""); + } } console.log(` ✓ Using Ollama on localhost:${OLLAMA_PORT}`); provider = "ollama-local"; @@ -3401,6 +3409,12 @@ async function setupNim(gpu) { console.log(" Starting Ollama..."); run(`OLLAMA_HOST=0.0.0.0:${OLLAMA_PORT} ollama serve > /dev/null 2>&1 &`, { ignoreError: true }); sleep(2); + console.log(""); + console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); + console.log(" This exposes the Ollama API to your local network (no auth required)."); + console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); + console.log(" See: CNVD-2025-04094, CVE-2024-37032"); + console.log(""); console.log(` ✓ Using Ollama on localhost:${OLLAMA_PORT}`); provider = "ollama-local"; credentialEnv = "OPENAI_API_KEY"; From 949fed195bccc495ad3d536677b85dd3272ff94b Mon Sep 17 00:00:00 2001 From: ColinM-sys Date: Tue, 14 Apr 2026 13:18:20 -0400 Subject: [PATCH 2/2] refactor: extract Ollama exposure warning into helper per CodeRabbit Signed-off-by: ColinM-sys --- src/lib/onboard.ts | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts index 10598116259..af0809bf9e5 100644 --- a/src/lib/onboard.ts +++ b/src/lib/onboard.ts @@ -1504,6 +1504,15 @@ async function promptOllamaModel(gpu = null) { return promptManualModelId(" Ollama model id: ", "Ollama"); } +function printOllamaExposureWarning() { + console.log(""); + console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); + console.log(" This exposes the Ollama API to your local network (no auth required)."); + console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); + console.log(" See: CNVD-2025-04094, CVE-2024-37032"); + console.log(""); +} + function pullOllamaModel(model) { const result = spawnSync("bash", ["-c", `ollama pull ${shellQuote(model)}`], { cwd: ROOT, @@ -3343,14 +3352,7 @@ async function setupNim(gpu) { const ollamaEnv = isWsl() ? "" : `OLLAMA_HOST=0.0.0.0:${OLLAMA_PORT} `; run(`${ollamaEnv}ollama serve > /dev/null 2>&1 &`, { ignoreError: true }); sleep(2); - if (!isWsl()) { - console.log(""); - console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); - console.log(" This exposes the Ollama API to your local network (no auth required)."); - console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); - console.log(" See: CNVD-2025-04094, CVE-2024-37032"); - console.log(""); - } + if (!isWsl()) printOllamaExposureWarning(); } console.log(` ✓ Using Ollama on localhost:${OLLAMA_PORT}`); provider = "ollama-local"; @@ -3409,12 +3411,7 @@ async function setupNim(gpu) { console.log(" Starting Ollama..."); run(`OLLAMA_HOST=0.0.0.0:${OLLAMA_PORT} ollama serve > /dev/null 2>&1 &`, { ignoreError: true }); sleep(2); - console.log(""); - console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); - console.log(" This exposes the Ollama API to your local network (no auth required)."); - console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); - console.log(" See: CNVD-2025-04094, CVE-2024-37032"); - console.log(""); + printOllamaExposureWarning(); console.log(` ✓ Using Ollama on localhost:${OLLAMA_PORT}`); provider = "ollama-local"; credentialEnv = "OPENAI_API_KEY";