CVE-2026-100601

ClawHub SSRF via Unchecked DNS Resolution in Profile Image

Published Sep 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Analysis

Technical impact

The vulnerability in the ClawHub application lies in its public profile image preview feature, which accepts a user‑supplied URL and only checks the textual hostname against private‑address patterns. It does not verify the actual resolved IP address, allowing an attacker to provide a hostname that resolves to an internal network address. This produces a server‑side request forgery that can establish outbound connections to internal services. Although the maintainer ran a proof‑of‑concept that created an outbound connection to a loopback listener, no internal service access, credential disclosure, or code execution was demonstrated; nevertheless the potential for those outcomes exists.

Affected Systems

OpenClaw’s ClawHub product is affected. Any self‑hosted deployment running a version prior to the fix in commit 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 is vulnerable. The exact historical affected range is not fully defined, but the vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and fixed by PR #3683. The npm CLI and OpenClaw runtime are not impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that no authentication is required to trigger the flaw via a malicious URL in a public profile preview. A remote attacker can target internal resources, but the exploit would be limited to outbound connections initiated by ClawHub.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

openclaw

clawhub

unaffected

Version	Status	Constraints
`0`	affected	< 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
`8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650`	unaffected	—

No data.

Vendor Product Versions

Openclaw

Clawhub

Version	Status	Scheme	Platform
`[0,8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650)`	affected	generic	—
`8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650`	unaffected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update ClawHub to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or a newer commit; this removes the SSRF bug.
For self‑hosted instances that cannot update immediately, restrict image URL resolution in the preview feature to a whitelist of allowed domains or disable the feature entirely until a fix is applied.
Configure outbound firewall rules or network segmentation to block outbound connections from the ClawHub application to internal IP address ranges, limiting the impact of any remaining SSRF risk.

Generated by OpenCVE AI on September 26, 2026 at 14:59 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.328% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
https://github.com/openclaw/clawhub/security/advisories/GHSA-48gp-hx8w-wjvm
https://www.vulncheck.com/advisories/clawhub-ssrf-via-unchecked-dns-resolution-in-profile-image

History

Sep 30, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 26, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openclaw Openclaw clawhub
Vendors & Products		Openclaw Openclaw clawhub

Sep 26, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Title		ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Weaknesses		CWE-918
References		https://github.com/openclaw/clawhub/commit/8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 https://github.com/openclaw/clawhub/security/advisories/GHSA-48gp-hx8w-wjvm https://www.vulncheck.com/advisories/clawhub-ssrf-via-unchecked-dns-resolution-in-profile-image
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}`