Executive Summary

CVE-2026-53859 is a hostname validation vulnerability in OpenClaw versions before 2026.5.26. It arises because the software inconsistently handles trailing dots in hostnames, allowing attackers to bypass blocklist checks by appending a trailing dot to URLs.

This inconsistency means that URLs which should be blocked by hostname policies can be accessed by attackers using this trailing-dot notation, effectively circumventing intended restrictions.

The vulnerability is related to incomplete comparison and improper input validation issues (CWE-1023, CWE-20) and can lead to server-side request forgery (CWE-918).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to bypass hostname blocklists and access destinations that operators intended to block.

If the affected feature is enabled and accessible, attackers can exploit this to reach restricted resources, potentially leading to unauthorized access or data exposure.

The practical impact depends on the operator's configuration and whether untrusted inputs can reach the vulnerable code path.

Mitigations before patching include blocking private-network and metadata destinations at the proxy or network layer, keeping allowlists narrow, avoiding shared Gateways between untrusted users, and disabling the affected feature if not needed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves inconsistent hostname validation related to trailing dots in URLs, which can bypass blocklist checks. Detection involves monitoring requests to model- or workspace-derived URLs for hostnames that include trailing dots.

You can inspect network traffic or logs for URLs with trailing dots appended to hostnames that should be blocked. For example, using command-line tools like tcpdump or Wireshark to capture HTTP requests and grep or similar tools to filter for trailing dots in hostnames.

• Use tcpdump to capture HTTP traffic: tcpdump -i <interface> -A 'tcp port 80 or tcp port 443'
• Filter captured traffic for trailing dots in hostnames: grep -iE '\bhttps?://[^/]+\.'
• Check application logs or proxy logs for requests containing hostnames ending with a dot.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include blocking private-network and metadata destinations at the proxy or network layer until the affected OpenClaw version is patched.

Additional mitigations involve keeping channel and tool allowlists narrow, avoiding sharing Gateways between untrusted users, and disabling the affected feature if it is not necessary.

Upgrading OpenClaw to version 2026.5.26 or later, where the vulnerability is patched, is the definitive fix.

Useful 0 Not Useful 0