EUVD-2026-25345
GHSA-36qx-4ghf-xq84
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SSRF bypass requiring authenticated access (PR:L) and knowledge of internal IPv6 targets (AC:H); scope changes to internal systems with high confidentiality impact when internal services are reachable.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.28.
DescriptionCVE.org
OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections.
AnalysisAI
OpenClaw versions up to and including 2026.3.24 permit SSRF guard bypass because the IPv6 address classifier in src/shared/net/ip.ts and src/infra/net/ssrf.* omits four IPv6 special-use ranges, incorrectly treating those addresses as public. Authenticated users with the ability to supply fetch URLs can target internal or non-routable IPv6 services that the guard should block, with potential high confidentiality impact on downstream internal systems (SC:H in CVSS 4.0). No public exploit code or active exploitation has been identified; EPSS stands at 0.04% (12th percentile) and SSVC rates exploitation as none, placing real-world urgency at medium priority pending the available upgrade to 2026.3.28.
Technical ContextAI
OpenClaw is an npm package (cpe:2.3:a:openclaw:openclaw) that provides application-level SSRF protection by classifying destination IP addresses as internal or public before permitting outbound fetches. The vulnerability is rooted in CWE-184 (Incomplete List of Disallowed Inputs): the blocklist maintained in src/shared/net/ip.ts accounts for common IPv4 private ranges and some IPv6 reserved blocks but omits four IPv6 special-use address ranges - likely spanning subsets of unique-local (fc00::/7), link-local (fe80::/10), or other IANA-designated non-routable IPv6 space (the advisory does not enumerate the four ranges explicitly). Because those ranges fall outside the classifier's blocklist, crafted URLs targeting addresses within them are evaluated as externally routable, and the SSRF guard permits the outbound request. The flaw is purely a logic-completeness defect in the IP classification table, not a parsing or memory-safety issue.
RemediationAI
Upgrade the OpenClaw npm package to version 2026.3.28 or later, which is confirmed as the patched release per the GitHub Security Advisory GHSA-g86v-f9qv-rh6m. The fix is delivered in commit d61f8e5672 ('Net: block missing IPv6 special-use ranges'). Run npm install openclaw@2026.3.28 or update the version constraint in package.json to >=2026.3.28 and re-lock. Advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-g86v-f9qv-rh6m. If immediate upgrade is not feasible, two compensating controls are available: first, restrict which application roles or authenticated users can supply arbitrary fetch URLs to OpenClaw, reducing the pool of potential exploiters (trade-off: may require application-layer changes and may not block compromised low-privilege accounts); second, deploy network-level IPv6 egress filtering at the firewall or infrastructure layer to block outbound connections from the OpenClaw host to internal IPv6 ranges (trade-off: operational overhead, must enumerate the relevant IPv6 ranges, and will not prevent exploitation if the attacker and target share the same network segment with no firewall in between). Neither workaround eliminates the flaw; patching to 2026.3.28 is the authoritative fix.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today