OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass in strict URL fetch paths. The vulnerability allows attackers to override DNS pinning when the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are present, enabling requests to be routed through a configured proxy instead of the pinned destination. This facilitates a Server‑Side Request Forgery (SSRF) bypass that can reach internal targets reachable through the proxy. The weakness is classified as CWE‑918 (Server Side Request Forgery).

The affected product is OpenClaw:OpenClaw with all releases before 2026.3.2. No more granular version data is provided in the CNA affected version list.

The CVSS score of 6.1 indicates a medium severity vulnerability. The EPSS score is not available, and issue is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack requires the attacker to influence the environment variables used by the application, typically via an SSRF scenario that injects or exploits proxy configuration. Once executed, the attacker can connect to arbitrary internal hosts that are reachable through the proxy, potentially allowing reconnaissance, data exfiltration, or further lateral movement. The exploit is likely to be network based and requires the attacker to be able to influence or hijack the environment in which OpenClaw runs.