CVE-2026-100574
Received Received - Intake

OpenClaw SSRF Bypass via DNS Manipulation

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses the SSRF destination validation. An attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response; the practical impact depends on the reachable service and the data it returns. Fixed in 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100574
EUVD
EUVD-2026-87477

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw before version 2026.8.1 has a Server-Side Request Forgery (SSRF) vulnerability in its trusted-host DNS checks. An attacker who can manipulate DNS for an allowed hostname can bypass SSRF destination validation by resolving the hostname to an unspecified address like 0.0.0.0 or ::. This allows the attacker to force a guarded fetch to reach a service bound only to loopback interfaces, potentially exposing sensitive data depending on the reachable service.

Detection Guidance

To detect this vulnerability, check if your OpenClaw version is before 2026.8.1. Use commands like 'npm list openclaw' to verify the installed version. Inspect network logs for unexpected outbound requests to loopback addresses (0.0.0.0 or ::) from OpenClaw processes.

Impact Analysis

If exploited, this vulnerability could allow an attacker to access internal services running on loopback addresses (like 127.0.0.1) that should be protected. The impact depends on the services exposed; sensitive data could be disclosed if those services return confidential information. The attacker needs to influence DNS for an allowed hostname to trigger the issue.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of confidential information via SSRF may result in non-compliance, regulatory penalties, or data breach notifications depending on the affected service and data involved.

Mitigation Strategies

Immediately upgrade OpenClaw to version 2026.8.1 or later. Remove or restrict DNS manipulation capabilities for trusted hostnames. Review and tighten network policies to block outbound connections to loopback addresses from OpenClaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart