Server-Side Request Forgery Vulnerability in ClawHub by OpenClaw

CVE-2026-100601

What is CVE-2026-100601?

The ClawHub application suffers from a server-side request forgery vulnerability, specifically in the public profile preview image fetching feature. This flaw arises due to inadequate validation of user-supplied image URLs, allowing a malicious hostname to resolve to an internal network address. The vulnerability permits potential access to internal services through DNS rebinding. Although a proof-of-concept demonstrated the possibility of an outbound connection to an attacker-controlled loopback listener, the risk of credential exposure and code execution was not explicitly verified. Users are urged to update to the patched version released on September 11, 2026, to ensure protection against this security concern. Self-hosted instances should prioritize updating to the specified revision or a later one.

References