CVE-2026-100576: OpenClaw SSRF Vulnerability

CVE-2026-100576 Overview

CVE-2026-100576 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting OpenClaw versions before 2026.8.1. The flaw resides in the browser wait predicates subsystem. Authenticated attackers can invoke the wait --fn function against an existing browser session to reach loopback or private network destinations. These requests bypass the navigation checks that OpenClaw applies to other browser actions, defeating the project's SSRF protections.

Critical Impact
Attackers with low privileges can abuse an active browser session to pivot into internal services, cloud metadata endpoints, or loopback-bound administrative interfaces that should be unreachable from OpenClaw.

Affected Products

OpenClaw versions prior to 2026.8.1
OpenClaw deployments exposing browser automation to multi-tenant or untrusted users
Environments where OpenClaw runs adjacent to private network ranges or cloud metadata services

Discovery Timeline

2026-09-26 - CVE-2026-100576 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100576

Vulnerability Analysis

OpenClaw provides browser automation primitives that include navigation actions and wait predicates. Navigation actions enforce destination allowlists to prevent SSRF against internal networks. The wait predicate exposed through wait --fn evaluates a function inside the active browser session but does not apply the same destination filtering. An attacker who already has access to a browser session can execute arbitrary fetch logic that resolves to blocked destinations such as 127.0.0.1, 169.254.169.254, or RFC1918 ranges.

Because the request is issued from the server-side browser context, downstream services observe the OpenClaw host as the origin. This enables reconnaissance of internal HTTP services, interaction with cloud metadata APIs, and retrieval of responses that would otherwise be unreachable from the attacker's network position.

Root Cause

The root cause is inconsistent enforcement of SSRF protections across OpenClaw browser action handlers. Navigation handlers validate target URLs, while the wait predicate handler executes caller-supplied functions without routing their outbound requests through the same validation layer. This is a classic missing-authorization gap in a sensitive sink, mapped to CWE-918.

Attack Vector

Exploitation requires network access to OpenClaw and a valid session with permission to drive an existing browser instance. The attacker submits a wait --fn call whose predicate issues a fetch to an internal destination. The browser executes the predicate, the request leaves the OpenClaw host, and the response is returned to the attacker through normal API output. No user interaction is required beyond holding a low-privileged account.

Refer to the GitHub Security Advisory GHSA-4g58-43jr-6738 and the Vulncheck Advisory for OpenClaw SSRF for maintainer-provided technical details. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2026-100576

Indicators of Compromise

Outbound connections from the OpenClaw host to loopback addresses or RFC1918 ranges that did not occur before upgrade activity.
Requests from OpenClaw to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
OpenClaw audit logs showing wait --fn invocations containing fetch, XMLHttpRequest, or URL literals referencing internal hostnames.

Detection Strategies

Parse OpenClaw session logs for wait actions whose predicate payloads contain network APIs or private IP literals.
Correlate browser session identifiers with egress proxy or firewall logs to flag requests destined for non-public ranges.
Alert on unexpected 2xx responses from internal services where the source is the OpenClaw service account.

Monitoring Recommendations

Forward OpenClaw application logs and host network telemetry into a centralized analytics pipeline for query across sessions and users.
Baseline normal destinations for the OpenClaw host and alert on first-seen internal destinations.
Review all accounts with permission to drive browser sessions and audit their recent wait predicate usage.

How to Mitigate CVE-2026-100576

Immediate Actions Required

Upgrade OpenClaw to version 2026.8.1 or later on every host running the service.
Rotate any credentials, tokens, or cloud metadata-derived secrets that could have been exposed through the OpenClaw host.
Restrict OpenClaw API access to authenticated, trusted operators until the patch is deployed.

Patch Information

The maintainers address this issue in OpenClaw 2026.8.1 by applying navigation-equivalent destination checks to the wait predicate pathway. See the GitHub Security Advisory GHSA-4g58-43jr-6738 for the fixed version and release notes.

Workarounds

Place OpenClaw behind an egress proxy that blocks loopback, link-local, and RFC1918 destinations until upgrade.
Deploy host firewall rules on the OpenClaw server to deny outbound traffic to internal subnets and cloud metadata IPs.
Disable or restrict the wait --fn capability through role-based access control if deployment supports it.
Run OpenClaw in a network segment with no route to sensitive internal services.

bash

# Example egress restriction using iptables on the OpenClaw host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT