OpenClaw before version 2026.3.28 contains a flaw in its SSRF guard that fails to filter four IPv6 special‑use ranges. An attacker can craft URLs that reference internal or non‑routable IPv6 addresses and send them to the application; the guard will allow the request to proceed, enabling the attacker to reach resources on the internal network that are otherwise unreachable from the outside. This flaw does not directly provide code execution but can expose sensitive internal endpoints or data.

The affected vendor is OpenClaw and the product is OpenClaw. Versions prior to 2026.3.28 are vulnerable. No other versions are listed as affected.

The base CVSS score of 5.1 indicates moderate severity with no exploit resulting in direct code execution. The EPSS score of less than 1 % suggests the risk of real‑world exploitation is low at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a normal SSRF request path that accepts externally supplied URLs; the attacker must have network reach to the vulnerable application, and the vulnerability does not require additional privileged access to the server. While it can allow internal network discovery or data exfiltration, it does not expose the system to remote code execution without further weaknesses.