OpenClaw, a gateway agent distributed as an npm package, validated only the DNS result of a configured remote Chrome DevTools Protocol (CDP) hostname. However, the WebSocket and Playwright transports performed a second DNS lookup, effectively bypassing the initial validation. An attacker controlling the approved CDP hostname or its DNS responses can perform a DNS rebinding attack, causing OpenClaw to connect to loopback, private, link‑local, cloud‑metadata, or other internally restricted addresses. The resulting SSRF can expose internal network services, data, or allow further lateral movement, depending on the remote CDP configuration, timing, and reachable services from the Gateway host.

OpenClaw software versions from 2026.4.5 up to, but not including, 2026.8.1 are affected. These versions are identified by the vendor OpenClaw and the product name OpenClaw. The vulnerability is not present in the fixed release 2026.8.1 or later.

The CVSS score is 8.9, indicating a high severity. The EPSS score is not available, so the exploitation probability cannot be quantified, but the lack of a KEV listing suggests no widespread exploitation has been documented yet. The attack requires control over the CDP hostname or its DNS records and relies on a check‑then‑use flaw in DNS resolution. If achieved, an attacker can force the gateway to reach otherwise blocked addresses, enabling SSRF and possibly escalating to internal reconnaissance or privilege escalation. Immediate patching or disabling the vulnerable feature is strongly recommended.