EUVD-2026-37161
GHSA-gxg4-2rrr-jhc7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible exploit requires authenticated access (PR:L); trailing-dot technique is trivially simple (AC:L) once authenticated; scope unchanged with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs. Attackers can exploit inconsistent hostname checks to reach destinations that operators intended to block through hostname policies.
AnalysisAI
Hostname blocklist bypass in OpenClaw before 2026.5.26 enables authenticated attackers to reach operator-restricted network destinations by supplying trailing-dot notation in model- or workspace-derived URLs. The comparison logic evaluating hostnames against blocklist policies does not normalize fully qualified domain name (FQDN) trailing dots before evaluation, while DNS resolvers treat blocked.example.com. and blocked.example.com as identical targets. With confidentiality impact rated High by CVSS 4.0 and no public exploit or KEV listing identified at time of analysis, risk is real but bounded to deployments with active blocklist policies and users who control URL parameters.
Technical ContextAI
OpenClaw is an application platform where operators define hostname-based blocklist policies to restrict outbound URL targets accessible from model or workspace contexts. The vulnerability is classified as CWE-1023 (Incomplete Comparison with Missing Factors) - the blocklist comparison logic omits the trailing-dot case, a valid RFC-compliant representation of a fully qualified domain name. DNS resolvers normalize trailing dots transparently, so malicious.internal. resolves identically to malicious.internal, but the string comparison in OpenClaw's blocklist engine treats them as distinct hostnames. The CPE string cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* confirms all OpenClaw releases prior to 2026.5.26 carry this flaw. The CVSS 4.0 AT:P metric (attack requirements present) reflects that specific deployment conditions - an active blocklist and attacker-influenced URL input - must both be in place for exploitation to succeed.
RemediationAI
Upgrade OpenClaw to version 2026.5.26 or later, as documented in the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-gxg4-2rrr-jhc7. Prior to patching, operators should implement egress proxy normalization that strips trailing dots from hostnames before forwarding requests, ensuring blocklist comparisons occur against normalized forms. Alternatively, disabling or restricting the model- and workspace-derived URL features for untrusted user roles eliminates the attack surface at the cost of reduced functionality. Tightening role-based access controls so that only trusted operators - not end users - can define or modify URL parameters reduces authenticated exposure. Note that proxy-based FQDN normalization may affect edge-case DNS behaviors in environments that rely on explicit FQDN dot-termination.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today