OpenClaw Networking Flaw Exposes Ollama API to Unauthenticated LLM Poisoning — Detection and Remediation Guide

---
title: Ollama API Model Mutation via Network-Exposed Endpoint
id: 3c9a7f21-8b2e-4d61-a9c4-5e7f2b8d1034
status: experimental
description: Detects Ollama model management API calls (push, pull, create, delete) in web or proxy logs, which may indicate LLM poisoning activity against an exposed Ollama server such as those reachable via the OpenClaw networking flaw.
references:
  - https://www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain_compromise
  - attack.t1195
  - attack.persistence
logsource:
  category: webserver
detection:
  selection_uri:
    c-uri|contains:
      - '/api/push'
      - '/api/pull'
      - '/api/create'
      - '/api/delete'
      - '/api/blobs'
  selection_port:
    c-uri|contains: '11434'
  condition: selection_uri or selection_port
falsepositives:
  - Legitimate model management by ML engineering teams during scheduled deployments
level: high
---
title: Ollama Server Listening on Non-Loopback Interface
id: 6f2d8b14-4a93-4e27-bc81-9d3e5a7f6021
status: experimental
description: Detects the ollama process bound to a non-localhost address, indicating the model server is network-reachable and exposed to unauthenticated access as described in the OpenClaw networking disclosure.
references:
  - https://www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|contains:
      - 'ollama'
  selection_port:
    DestinationPort: 11434
  selection_external:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '192.168.'
  condition: selection_process and selection_port and selection_external
falsepositives:
  - Intentionally exposed Ollama servers in development environments (still a finding to remediate)
level: high
---
title: Ollama Process Initiating Outbound Model Pull to Unfamiliar Host
id: 9b4e6c35-2f18-4d73-ae92-7c1b3d5e8046
status: experimental
description: Detects the ollama process making outbound network connections to non-standard destinations, which may indicate an attacker using the pull API to stage poisoned model blobs from external infrastructure.
references:
  - https://www.darkreading.com/cyber-risk/nemo-claw-networking-llm-poisoning-openclaw
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ollama.exe'
      - '\ollama app.exe'
    Initiated: 'true'
  filter_known_registries:
    DestinationHostname|contains:
      - 'ollama.com'
      - 'ollama.ai'
      - 'huggingface.co'
  condition: selection and not filter_known_registries
falsepositives:
  - Custom model registries hosted on internal infrastructure
  - Corporate artifact mirrors
level: medium

// Hunt for network connections to Ollama API port 11434 from non-localhost sources
// Covers both Syslog/CEF-ingested Linux hosts and Defender-onboarded endpoints
let OllamaPort = 11434;
let Lookback = 7d;
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where LocalPort == OllamaPort or RemotePort == OllamaPort
| where RemoteIP !in ("127.0.0.1", "::1") and not(RemoteIP startswith "127.")
| project TimeGenerated, DeviceName, LocalIP, LocalPort, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, Source = "DeviceNetworkEvents"),
(CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DestinationPort == OllamaPort
| where SourceIP !startswith "127."
| project TimeGenerated, DeviceName = DeviceName, LocalIP = DestinationIP, LocalPort = DestinationPort, RemoteIP = SourceIP, RemotePort = SourcePort, InitiatingProcessFileName = ApplicationProtocol, InitiatingProcessCommandLine = "", Source = "CommonSecurityLog")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), UniqueSources = dcount(RemoteIP)
    by DeviceName, LocalIP, RemoteIP, Source
| where UniqueSources > 1 or ConnectionCount > 50
| sort by UniqueSources desc

-- Hunt for Ollama exposure: process bindings, unexpected API clients, and recently modified model files
-- Artifact 1: Check whether ollama is listening on a non-loopback interface
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Name =~ '(?i)ollama'

-- Artifact 2: Enumerate active connections on port 11434 and flag non-loopback peers
SELECT Pid, Name, LocalAddr, RemoteAddr, State
FROM netstat()
WHERE LocalAddr =~ ':11434'
  AND RemoteAddr !~ '^(127\.|\[::1\]|0\.0\.0\.0|\[::\])'

-- Artifact 3: Identify recently modified Ollama model manifests and blobs
-- (poisoned models appear as unexpected mtime changes under the model store)
SELECT FullPath, Size, Mtime
FROM glob(globs=['/home/*/.ollama/models/manifests/**/*', '/root/.ollama/models/manifests/**/*', 'C:/Users/*/.ollama/models/manifests/**/*'])
WHERE Mtime > (now() - 604800)  -- modified in the last 7 days
ORDER BY Mtime DESC

#!/bin/bash
# OpenClaw/Ollama exposure verification and hardening script
# Run on any Linux host running OpenClaw or Ollama. Requires root for full checks.

set -euo pipefail
echo "=== Ollama Exposure Assessment ==="

# 1. Check if ollama is listening on any non-loopback interface
echo "[1] Checking Ollama bind address..."
if ss -tlnp 2>/dev/null | grep -E ':11434' | grep -vE '127\.0\.0\.1|\[::1\]'; then
    echo "[ALERT] Ollama is listening on a non-loopback interface — host is EXPOSED."
    EXPOSED=1
else
    echo "[OK] Ollama is not listening externally (or not running)."
    EXPOSED=0
fi

# 2. Check OLLAMA_HOST environment configuration in systemd and shell profiles
echo "[2] Checking OLLAMA_HOST configuration..."
grep -rE 'OLLAMA_HOST' /etc/systemd/system/ /usr/lib/systemd/system/ ~/.bashrc ~/.profile /etc/profile.d/ 2>/dev/null | grep -v '127.0.0.1' || echo "[OK] No insecure OLLAMA_HOST overrides found."

# 3. Force localhost binding via systemd override
echo "[3] Applying localhost-only binding via systemd override..."
mkdir -p /etc/systemd/system/ollama.service.d
cat > /etc/systemd/system/ollama.service.d/bind-localhost.conf <<'EOF'
[Service]
Environment="OLLAMA_HOST=127.0.0.1:11434"
EOF
systemctl daemon-reload
systemctl restart ollama 2>/dev/null || echo "[INFO] ollama systemd service not found — set OLLAMA_HOST=127.0.0.1:11434 in your process manager."

# 4. Add firewall defense-in-depth (host-level block on 11434 from non-loopback)
echo "[4] Adding firewall rule to block external access to TCP/11434..."
if command -v iptables >/dev/null 2>&1; then
    iptables -C INPUT -p tcp --dport 11434 ! -i lo -j DROP 2>/dev/null || \
    iptables -A INPUT -p tcp --dport 11434 ! -i lo -j DROP
    echo "[OK] iptables DROP rule installed for external 11434 traffic."
fi
if command -v nft >/dev/null 2>&1; then
    nft add rule inet filter input tcp dport 11434 iif != "lo" drop 2>/dev/null || true
fi

# 5. Audit for unauthorized model changes (mtime in last 14 days)
echo "[5] Auditing model store for recent modifications..."
for dir in /root/.ollama/models /home/*/.ollama/models; do
    if [ -d "$dir" ]; then
        find "$dir" -type f -mtime -14 -printf '%TY-%Tm-%Td %TH:%TM  %p\n' 2>/dev/null
    fi
done

# 6. Verify final state
echo "[6] Post-hardening verification..."
ss -tlnp 2>/dev/null | grep ':11434' || echo "[OK] Port 11434 no longer exposed or ollama not running."

if [ "$EXPOSED" -eq 1 ]; then
    echo ""
    echo "[ACTION REQUIRED] This host was exposed. Treat all installed models as suspect:"
    echo "  - Re-pull every model from a trusted source: ollama rm <model> && ollama pull <model>"
    echo "  - Review agent outputs generated since first exposure for signs of poisoned behavior."
fi
echo "=== Assessment complete ==="