ClawHub CVE-2026-100601

Exploitation requires reaching the public profile preview's image-fetching feature and supplying an image URL whose hostname passes the textual private-address pattern check while its DNS resolution points to an internal or loopback address (or changes between validation and connection via DNS rebinding). Limiting factors: impact is scoped to the preview's outbound fetch - the reporter only demonstrated a loopback connection and did NOT show access to production internal services, credential disclosure, or code execution; the hosted clawhub.ai instance was patched on 2026-09-11, so only self-hosted deployments running revision cbfee734 (or unfixed ancestors) before revision 8c2de6c5 remain exposed. The npm CLI and OpenClaw runtime are separate products and are unaffected.

This is a genuine but modest-impact SSRF (CWE-918) in the ClawHub profile-image preview, reported by VulnCheck with a vendor CVSS 4.0 base of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L). The signals are internally consistent and, importantly, honest: the vendor scored NO confidentiality impact on the vulnerable system and only LOW subsequent-system C/I/A, matching the description's explicit statement that a maintainer-run local harness only demonstrated an outbound connection to an owner-controlled loopback listener - access to production internal services, credential disclosure, and code execution were NOT demonstrated. There is no EPSS score provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The one clear conflict is the 'RCE' tag: nothing in the description, CVSS vector, or advisory supports remote code execution - it directly contradicts the stated 'code execution was not demonstrated.' Net: this is a real-but-low-priority SSRF whose worst realistic outcome is reaching internal/loopback services, not a high-urgency issue; the hosted clawhub.ai instance was already patched on 2026-09-11, so residual risk is limited to un-updated self-hosted deployments.

An attacker submits a crafted image URL to ClawHub's public profile preview using a public-looking hostname that either resolves directly to an internal/loopback address or flips resolution after the textual private-address check passes (DNS rebinding). The server then fetches the URL, opening a connection to an internal service the attacker chose; the maintainer's own harness confirmed an outbound connection to a loopback listener, but no internal data exfiltration, credential theft, or code execution was shown. No public exploit code is referenced.