CVE-2026-100567: OpenClaw DNS Rebinding SSRF Vulnerability

CVE-2026-100567 Overview

CVE-2026-100567 is a Server-Side Request Forgery (SSRF) vulnerability in OpenClaw, an agent gateway distributed as the npm package openclaw. The flaw affects versions >= 2026.4.5 and < 2026.8.1. The Gateway validates a single Domain Name System (DNS) resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname. However, the raw WebSocket and Playwright transports perform a later, independent DNS resolution that discards the DNS pinning enforced during validation. An attacker who controls an approved CDP hostname or its DNS answers can abuse this check-then-use gap through DNS rebinding. The issue is tracked under [CWE-918].

Critical Impact
Successful exploitation lets an attacker redirect Gateway connections to loopback, private, link-local, or cloud metadata endpoints, enabling SSRF against services reachable from the Gateway host.

Affected Products

OpenClaw npm package openclaw versions >= 2026.4.5
OpenClaw npm package openclaw versions < 2026.8.1
Gateway deployments configured with hostname-based remote CDP endpoints

Discovery Timeline

2026-09-26 - CVE-2026-100567 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100567

Vulnerability Analysis

The OpenClaw Gateway accepts a remote CDP endpoint identified by hostname. During validation, the Gateway resolves the hostname once and checks the returned address against its SSRF policy. The policy rejects loopback, private, link-local, and cloud metadata ranges. The validation layer then passes the hostname, not the resolved address, to downstream transports. The raw WebSocket and Playwright transports resolve the hostname again at connection time. This second lookup bypasses the pinning performed at validation, creating a classic time-of-check to time-of-use window.

An attacker who controls DNS answers for an approved hostname can return a public address during validation and a restricted address during the transport connection. The Gateway then opens a CDP session against the attacker-selected internal target. Reachable services may include cloud instance metadata endpoints, internal admin interfaces, or local debugging ports.

Root Cause

The root cause is a check-then-use gap between SSRF validation and transport connection. The validation layer enforces DNS pinning on a single resolution result. The transport layer performs an independent resolution, so the pinned address is discarded before the socket is opened.

Attack Vector

The attack requires network reachability to the Gateway and control over either an approved CDP hostname or its authoritative DNS answers. The attacker configures a short Time-To-Live (TTL) record and alternates responses between a policy-allowed address and a restricted internal address. Refer to the GitHub Security Advisory and the VulnCheck Advisory on OpenClaw for additional transport-level detail.

Detection Methods for CVE-2026-100567

Indicators of Compromise

Outbound CDP or WebSocket connections from the Gateway host to loopback (127.0.0.0/8), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or link-local (169.254.0.0/16) addresses.
Gateway logs showing a successful remote CDP validation followed by a transport connection to an unexpected IP for the same hostname.
DNS queries from the Gateway resolving the same hostname to differing addresses within short intervals.

Detection Strategies

Correlate validation-time and connection-time DNS resolutions for identical hostnames and alert on mismatches.
Flag CDP sessions whose peer address falls inside SSRF-denied CIDR ranges, including cloud metadata endpoints such as 169.254.169.254.
Monitor Gateway process network telemetry for connections initiated by Playwright or raw WebSocket transports to RFC1918 destinations.

Monitoring Recommendations

Enable verbose transport logging in OpenClaw and ship logs to a centralized Security Information and Event Management (SIEM) platform.
Capture egress NetFlow or VPC Flow Logs from Gateway hosts and baseline expected CDP destinations.
Instrument the Gateway host DNS resolver to log low-TTL answers for CDP hostnames.

How to Mitigate CVE-2026-100567

Immediate Actions Required

Upgrade the openclaw npm package to version 2026.8.1 or later.
Audit Gateway configurations for hostname-based remote CDP endpoints and remove any that are not strictly required.
Restrict Gateway egress at the network layer to deny loopback, private, link-local, and cloud metadata ranges.

Patch Information

The maintainers fixed the issue in OpenClaw 2026.8.1. The patch aligns the transport layer with the validation layer so that both operate on the same resolved address. Review the GitHub Security Advisory GHSA-p3h6-v2h4-36q2 for release notes and upgrade guidance.

Workarounds

Disable hostname-based remote CDP endpoints in Gateway configuration where feasible.
Restrict remote CDP endpoints to trusted, stable infrastructure under direct administrative control.
Enforce egress filtering that blocks Gateway connections to SSRF-denied CIDR ranges and cloud metadata addresses.

bash

# Upgrade OpenClaw to the fixed release
npm install openclaw@2026.8.1

# Verify installed version
npm ls openclaw