CVE-2026-6011: OpenClaw assertPublicHostname web-fetch.ts server-side request forgery
A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2026.1.29 can resolve this issue. This patch is called b623557a2ec7e271bda003eb3ac33fbb2e218505. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw assertPublicHostname Handlerto a version that resolves this vulnerability.Fixed in 2026.1.29Patch b623557a2ec7e271bda003eb3ac33fbb2e218505 - Compensating control
Because exploitation allows server-side request forgery (SSRF) and can be executed remotely, restrict network egress from the OpenClaw host/app (where src/agents/tools/web-fetch.ts runs) so outbound connections to internal/private targets are blocked.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6011?
CVE-2026-6011 has been classified as a moderate severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2026-6011?
To fix CVE-2026-6011, upgrade OpenClaw to version 2026.1.27 or later as this version addresses the identified vulnerability.
What type of vulnerability is CVE-2026-6011?
CVE-2026-6011 is a server-side request forgery (SSRF) vulnerability found in the assertPublicHostname function of OpenClaw.
What versions of OpenClaw are affected by CVE-2026-6011?
CVE-2026-6011 affects OpenClaw versions up to and including 2026.1.26.
Is CVE-2026-6011 easy to exploit?
CVE-2026-6011 can be relatively easy to exploit if an attacker can manipulate the requests sent through the vulnerable component.