CVE-2026-100574: OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses the SSRF destination validation. An attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response; the practical impact depends on the reachable service and the data it returns. Fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using OpenClaw before 2026.8.1 are exposed when they perform guarded fetches using the trusted-host DNS recheck. Exploitation also requires an allowed hostname whose DNS records an attacker can influence.
What can an attacker access through the bypass?
An attacker can cause a guarded fetch to reach a service bound only to loopback and disclose that service's response. The actual impact depends on which loopback-reachable service is present and what data it returns.
What should be done if immediate patching is not possible?
The provided information does not describe a workaround. Prioritize preventing attacker control over DNS for allowed hostnames and upgrade to 2026.8.1 when possible.