CVE-2026-100567: OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports performed a later, independent DNS resolution, discarding the DNS pinning enforced at validation time. An attacker who controls an approved CDP hostname or its DNS answers can exploit this check-then-use gap via DNS rebinding to make the Gateway connect to a loopback, private, link-local, cloud metadata, or other SSRF-policy-denied address. The impact depends on the remote CDP configuration, DNS timing, and the services reachable from the Gateway host. The issue is fixed in 2026.8.1; as a mitigation, disable hostname-based remote CDP endpoints or restrict them to trusted, stable infrastructure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1 - Configuration
Disable hostname-based remote CDP endpoints.
OpenClaw Gateway hostname-based remote CDP endpoints = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
OpenClaw deployments using versions 2026.4.5 through before 2026.8.1 are exposed when they are configured with hostname-based remote Chrome DevTools Protocol endpoints. Exposure depends on the remote CDP configuration and the DNS behavior of the configured hostname.
What does an attacker need to exploit this?
An attacker must control an approved remote CDP hostname or be able to control its DNS answers. They also need to exploit the timing gap between the Gateway's validation-time DNS lookup and the later lookup used by the WebSocket or Playwright transport.
What can the Gateway be induced to reach?
A successful DNS rebinding attack can cause the Gateway to connect to addresses that its SSRF policy would normally deny, including loopback, private, link-local, and cloud metadata addresses. The resulting impact depends on what services are reachable from the Gateway host.
What should be done if upgrading is not immediately possible?
Disable hostname-based remote CDP endpoints, or restrict them to trusted, stable infrastructure. The issue is fixed in OpenClaw 2026.8.1.