Server-Side Request Forgery in OpenClaw npm Package by OpenClaw

CVE-2026-100574

What is CVE-2026-100574?

The OpenClaw npm package before version 2026.8.1 contains a server-side request forgery (SSRF) flaw associated with its trusted-host DNS checks. This vulnerability allows requests to bypass destination validation if a trusted hostname resolves to an unspecified address (such as 0.0.0.0). As a result, an attacker with control over DNS for an allowed hostname can manipulate requests, potentially redirecting them to services that are only accessible via loopback interfaces. This poses risks depending on the data returned by those services, necessitating prompt updates to the latest version to mitigate this issue.

References