CVE-2026-42430: Openclaw SSRF Vulnerability

CVE-2026-42430 Overview

OpenClaw before version 2026.4.8 contains a server-side request forgery (SSRF) vulnerability in its Playwright redirect handling implementation. This flaw allows attackers to bypass strict SSRF checks by exploiting request-time navigation, enabling access to private internal targets that should be restricted by browser-based SSRF protections.

Critical Impact
Attackers can bypass security controls to reach internal network resources, potentially exposing sensitive services and data that should be inaccessible from external requests.

Affected Products

OpenClaw versions prior to 2026.4.8
OpenClaw Node.js package (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*)

Discovery Timeline

2026-04-28 - CVE-2026-42430 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-42430

Vulnerability Analysis

This vulnerability exists in OpenClaw's network fetch guard mechanism, specifically in how DNS pinning is handled during proxy dispatch operations. The core issue stems from the order of operations in the fetch-guard.ts module, where DNS resolution and pinning occurred before determining the dispatch mode.

When a trusted environment proxy is configured, the application should skip DNS pinning entirely since the proxy handles resolution. However, in vulnerable versions, the DNS pinning operation (resolvePinnedHostnameWithPolicy) was executed unconditionally before the trusted proxy check, creating a window for SSRF bypass through redirect manipulation.

The vulnerability allows attackers to craft requests that pass initial URL validation but redirect to restricted internal targets during the Playwright navigation phase. Since DNS pinning occurred prematurely, the redirect destination was not subjected to the same strict SSRF checks applied to the original request.

Root Cause

The root cause is improper sequencing of security checks in the src/infra/net/fetch-guard.ts module. DNS resolution was performed before determining whether the request would be routed through a trusted environment proxy. This premature resolution allowed attackers to exploit the timing gap between initial URL validation and actual request dispatch.

The fix moves the resolvePinnedHostnameWithPolicy call to only execute when DNS pinning is actually required (i.e., when not using a trusted environment proxy or when pinDns is explicitly enabled).

Attack Vector

The attack leverages network-accessible endpoints that accept URL parameters. An attacker with low privileges can supply a URL that initially points to an allowed external destination but redirects to an internal service (such as metadata endpoints, internal APIs, or administrative interfaces). The Playwright redirect handling follows these redirects without re-validating against SSRF policies, bypassing the intended access controls.

typescript

     try {
       assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
       await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
-      const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
-        lookupFn: params.lookupFn,
-        policy: params.policy,
-      });
       const canUseTrustedEnvProxy =
         mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
       if (canUseTrustedEnvProxy) {
         dispatcher = createHttp1EnvHttpProxyAgent();
       } else if (params.pinDns === false) {
         dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
       } else {
+        const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+          lookupFn: params.lookupFn,
+          policy: params.policy,
+        });
         dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
       }

Source: GitHub Commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5

Detection Methods for CVE-2026-42430

Indicators of Compromise

Outbound requests to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) originating from OpenClaw application processes
HTTP redirect chains in application logs that terminate at internal service endpoints
Unexpected network connections from the application tier to internal infrastructure services

Detection Strategies

Monitor for HTTP 3xx redirect responses that lead to internal network destinations from externally-sourced requests
Implement network segmentation alerts for OpenClaw application servers attempting to access restricted internal services
Analyze application logs for URL parameters containing external domains known for redirect services
Deploy web application firewall rules to detect SSRF patterns in request parameters

Monitoring Recommendations

Enable verbose logging for the fetch-guard.ts module to track dispatcher selection and DNS resolution events
Implement network flow monitoring between application servers and internal services
Set up alerts for requests to cloud metadata endpoints (AWS, GCP, Azure) from application workloads

How to Mitigate CVE-2026-42430

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.8 or later immediately
Review application logs for evidence of SSRF exploitation attempts
Audit network firewall rules to restrict outbound access from OpenClaw servers to only required external destinations
Consider implementing network-level controls to block access to internal services from application tiers

Patch Information

The vulnerability is addressed in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5, which reorders the DNS pinning logic to execute only when necessary. The fix ensures that when a trusted environment proxy is configured, DNS resolution is delegated to the proxy rather than performed prematurely by the application.

For detailed patch information, see the GitHub Security Advisory GHSA-w8g9-x8gx-crmm and the VulnCheck SSRF Bypass Advisory.

Workarounds

Disable trusted environment proxy mode if not strictly required until patching is complete
Implement network-level egress filtering to block outbound connections to internal IP ranges from OpenClaw servers
Use a reverse proxy with SSRF protection to validate all outbound requests before they reach OpenClaw

bash

# Configuration example: Network-level mitigation using iptables
# Block outbound access to common internal ranges from application server
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP