CVE-2026-100574: OpenClaw npm Package SSRF Vulnerability

CVE-2026-100574 Overview

CVE-2026-100574 is a Server-Side Request Forgery (SSRF) vulnerability in the OpenClaw npm package (openclaw) affecting all versions before 2026.8.1. The flaw resides in the trusted-host DNS recheck logic used to validate destinations for outbound fetches. A trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses destination validation entirely. Attackers who can influence DNS for an allowed hostname can redirect guarded fetches toward loopback-bound services and disclose their responses. The vulnerability is tracked under CWE-918 and fixed in release 2026.8.1.

Critical Impact
Attackers controlling DNS for a trusted hostname can bypass SSRF protections and reach internal services bound to loopback, exposing their response data.

Affected Products

OpenClaw npm package (openclaw) versions prior to 2026.8.1
Applications depending on OpenClaw for trusted-host fetch validation
Deployments relying on OpenClaw's DNS recheck mechanism for SSRF protection

Discovery Timeline

2026-09-26 - CVE-2026-100574 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100574

Vulnerability Analysis

OpenClaw implements an allowlist-style defense that resolves trusted hostnames and then validates the resulting IP addresses before issuing outbound HTTP fetches. The DNS recheck path fails to treat the unspecified addresses 0.0.0.0 (IPv4) and :: (IPv6) as disallowed destinations. On most operating systems, connecting to 0.0.0.0 is interpreted as a connection to the local host, routing the request to services bound to the loopback interface. The destination validation therefore returns a false negative, and the HTTP client proceeds with a request to an internal service. The response is returned to the attacker-controlled calling context, enabling data disclosure from services never intended to be reachable externally.

Root Cause

The root cause is incomplete validation of resolved IP addresses in the trusted-host DNS recheck. The code enforces checks against private ranges and link-local addresses but omits the unspecified address class. Because DNS responses for an allowlisted hostname are trusted after a shallow filter, an attacker who controls the authoritative DNS for the trusted name can return 0.0.0.0 or :: and defeat the SSRF guard.

Attack Vector

Exploitation requires network access to a target application that uses OpenClaw's guarded fetch and the ability to influence DNS resolution for an allowed hostname. The attacker configures the authoritative DNS record for a trusted host to return 0.0.0.0 or ::. When the application resolves the hostname, OpenClaw's validator accepts the response. The outbound HTTP client then connects to loopback, reaching services such as metadata APIs, debugging endpoints, or internal admin interfaces. The response body is handed back through the originating application. Full technical details are available in the GitHub Security Advisory GHSA-72p2-79fg-pvph and the VulnCheck SSRF Advisory for OpenClaw.

Detection Methods for CVE-2026-100574

Indicators of Compromise

Outbound DNS resolutions for allowlisted hostnames returning 0.0.0.0 or ::
Application logs showing fetches that resolved to loopback or unspecified addresses
Unexpected inbound requests on loopback-bound services originating from the application process
Unusual response payloads returned to API consumers that match internal service response shapes

Detection Strategies

Inspect dependency manifests (package.json, package-lock.json) for openclaw versions below 2026.8.1
Log and alert on DNS answers resolving trusted hostnames to 0.0.0.0, ::, or other reserved ranges
Instrument the HTTP client layer to record the final resolved IP of each outbound request
Correlate anomalous DNS responses with subsequent fetch activity targeting internal services

Monitoring Recommendations

Enable egress proxy logging that captures resolved destination IPs alongside hostnames
Monitor loopback interface traffic on application hosts for unexpected process-level connections
Alert on DNS TTL anomalies for allowlisted hostnames that could indicate attacker-controlled zones
Review application telemetry for 200-level responses to fetches that produced unusually small or structured payloads

How to Mitigate CVE-2026-100574

Immediate Actions Required

Upgrade the openclaw package to version 2026.8.1 or later across all services
Audit all code paths that invoke OpenClaw's trusted-host fetch to confirm patched behavior
Rotate any secrets that may have been reachable through loopback-bound services during the exposure window
Review DNS resolver configuration to reject or flag responses containing unspecified addresses

Patch Information

The maintainers released a fix in OpenClaw 2026.8.1. The patched release extends the destination validator to reject the unspecified addresses 0.0.0.0 and :: in the DNS recheck path. Consumers should update via npm install openclaw@2026.8.1 or pin the fixed version in dependency manifests. Refer to the GitHub Security Advisory GHSA-72p2-79fg-pvph for release notes.

Workarounds

Restrict outbound network egress from application hosts using a filtering proxy that blocks loopback and unspecified-address destinations
Bind sensitive internal services to interfaces unreachable from the application process rather than loopback
Implement a secondary SSRF validator in application code that rejects resolved IPs in 0.0.0.0/8 and the IPv6 unspecified address
Reduce the trusted-host allowlist to the minimum set required and monitor DNS changes for those hosts

bash

# Configuration example
npm install openclaw@2026.8.1
npm ls openclaw