Description
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Published: 2026-09-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery to internal resources
Action: Apply Patch
AI Analysis

Impact

The vulnerability in the ClawHub application lies in its public profile image preview feature, which accepts a user‑supplied URL and only checks the textual hostname against private‑address patterns. It does not verify the actual resolved IP address, allowing an attacker to provide a hostname that resolves to an internal network address. This produces a server‑side request forgery that can establish outbound connections to internal services. Although the maintainer ran a proof‑of‑concept that created an outbound connection to a loopback listener, no internal service access, credential disclosure, or code execution was demonstrated; nevertheless the potential for those outcomes exists.

Affected Systems

OpenClaw’s ClawHub product is affected. Any self‑hosted deployment running a version prior to the fix in commit 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 is vulnerable. The exact historical affected range is not fully defined, but the vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 and fixed by PR #3683. The npm CLI and OpenClaw runtime are not impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that no authentication is required to trigger the flaw via a malicious URL in a public profile preview. A remote attacker can target internal resources, but the exploit would be limited to outbound connections initiated by ClawHub.

Generated by OpenCVE AI on September 26, 2026 at 14:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update ClawHub to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or a newer commit; this removes the SSRF bug.
  • For self‑hosted instances that cannot update immediately, restrict image URL resolution in the preview feature to a whitelist of allowed domains or disable the feature entirely until a fix is applied.
  • Configure outbound firewall rules or network segmentation to block outbound connections from the ClawHub application to internal IP address ranges, limiting the impact of any remaining SSRF risk.

Generated by OpenCVE AI on September 26, 2026 at 14:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Openclaw
Openclaw clawhub
Vendors & Products Openclaw
Openclaw clawhub

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Title ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}

Subscriptions

Openclaw Clawhub
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-30T12:47:18.560Z

Reserved: 2026-09-26T01:04:47.561Z

Link: CVE-2026-100601

cve-icon Vulnrichment

Updated: 2026-09-30T12:47:14.173Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-26T14:16:40.040

Modified: 2026-09-30T13:17:15.497

Link: CVE-2026-100601

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T22:29:53Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)