CVE-2026-53859: Openclaw Auth Bypass Vulnerability

CVE-2026-53859 Overview

CVE-2026-53859 is a hostname validation bypass affecting OpenClaw versions prior to 2026.5.26. The flaw enables attackers to evade blocklist comparisons by appending a trailing dot to hostnames in model or workspace-derived URLs. Because OpenClaw performs inconsistent hostname normalization, the blocklist sees one value while the underlying HTTP client resolves another. This mismatch lets attackers reach destinations that operators intended to block through hostname policies, producing a Server-Side Request Forgery (SSRF) condition tracked under [CWE-918].

Critical Impact
Attackers with low-privileged access can bypass network egress policies and reach internal or restricted endpoints from the OpenClaw server.

Affected Products

OpenClaw (Node.js) all versions before 2026.5.26
OpenClaw 2026.5.26-beta1
OpenClaw 2026.5.26-beta2

Discovery Timeline

2026-06-16 - CVE-2026-53859 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53859

Vulnerability Analysis

OpenClaw accepts URLs supplied through model definitions and workspace configuration. Before issuing outbound requests, it compares the hostname against an operator-defined blocklist. The comparison routine treats internal.example.com and internal.example.com. as distinct strings. However, DNS resolvers and most HTTP libraries treat the trailing-dot form as the fully qualified equivalent and route the request to the same host. An attacker who controls a model or workspace URL field can therefore reach blocked destinations, including internal services, cloud metadata endpoints, and other infrastructure reachable from the OpenClaw process.

Root Cause

The root cause is inconsistent hostname canonicalization between the policy enforcement layer and the network client. OpenClaw does not strip or normalize the trailing dot before performing the blocklist string comparison. This breaks the assumption that policy checks and request dispatch operate on identical hostname representations, a classic SSRF filter bypass pattern under [CWE-918].

Attack Vector

Exploitation requires network access and a low-privileged authenticated account that can define or modify model or workspace URLs. The attacker submits a URL such as https://restricted-host.internal./api containing the trailing dot. The blocklist comparison fails to match the entry for restricted-host.internal, so OpenClaw allows the request. The HTTP client then resolves the hostname normally and issues the request against the intended target. No user interaction is required. See the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-53859

Indicators of Compromise

Outbound HTTP requests from OpenClaw hosts containing trailing-dot hostnames in the Host header or DNS query logs.
Model or workspace configuration entries where URL fields contain hostnames ending in a dot character.
Application logs showing successful fetches to hostnames that match blocklist entries when the trailing dot is removed.

Detection Strategies

Audit OpenClaw configuration stores and databases for URL fields with trailing-dot hostnames.
Correlate DNS resolver logs from OpenClaw hosts with the configured blocklist after normalizing the trailing dot.
Alert on outbound connections from OpenClaw hosts to RFC1918 ranges, link-local addresses, or cloud metadata endpoints such as 169.254.169.254.

Monitoring Recommendations

Forward OpenClaw application logs and egress proxy logs to a centralized analytics platform for retroactive hunting on trailing-dot patterns.
Monitor for new or modified model and workspace definitions and review URL fields during change review.
Track failed and successful requests to hosts that should be unreachable per egress policy.

How to Mitigate CVE-2026-53859

Immediate Actions Required

Upgrade OpenClaw to version 2026.5.26 or later, which corrects the hostname normalization logic.
Inventory all model and workspace URL fields and remove any entries containing trailing-dot hostnames.
Restrict who can create or modify model and workspace configurations to trusted operators.

Patch Information

The maintainers released a fix in OpenClaw 2026.5.26. Refer to the GitHub Security Advisory GHSA-gxg4-2rrr-jhc7 for release notes and upgrade guidance.

Workarounds

Enforce egress filtering at the network layer using an allowlist of approved destinations rather than relying on application-level blocklists.
Place OpenClaw behind an HTTP forward proxy that performs strict hostname canonicalization and rejects trailing-dot variants.
Block outbound access from OpenClaw hosts to internal subnets and cloud metadata endpoints until the upgrade is applied.

bash

# Example iptables rule blocking cloud metadata access from the OpenClaw host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT