CVE-2026-100601
Received Received - Intake

Server-Side Request Forgery in ClawHub Application

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100601
EUVD
EUVD-2026-87696

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openclaw clawhub 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
openclaw clawhub From 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100601 is a Server-Side Request Forgery (SSRF) vulnerability in the ClawHub application. It occurs in the public profile preview's image fetching feature where the application accepts a user-supplied image URL. The vulnerability arises because the application checks the hostname against private-address patterns but fails to validate the resolved network destination. This allows a public-looking hostname to resolve to an internal address or change resolution between validation and connection, potentially enabling DNS rebinding attacks.

Detection Guidance

To detect this SSRF vulnerability in ClawHub, monitor outbound connections from your ClawHub instance to unexpected internal or loopback addresses. Check logs for profile image fetches from public URLs that resolve to private IPs. Use network monitoring tools like tcpdump or Wireshark to inspect connections to 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges.

Impact Analysis

This vulnerability could allow an attacker to make the server connect to internal services or resources it should not access. While a maintainer demonstrated an outbound connection to a loopback listener, the full impact was not confirmed. Potential risks include unauthorized access to internal services, though credential disclosure or code execution was not demonstrated in testing.

Mitigation Strategies

Immediately update ClawHub to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or later. Disable profile image fetching if not critical. Restrict outbound network access for the ClawHub process to prevent unauthorized connections. Review and block suspicious DNS resolutions in your network firewall or DNS server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart