CVE-2026-6011 Details
Description
A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2026.1.29 can resolve this issue. This patch is called b623557a2ec7e271bda003eb3ac33fbb2e218505. Upgrading the affected component is advised.
A server-side request forgery (SSRF) vulnerability has been identified in OpenClaw versions through 2026.1.26. The issue resides in the web-fetch tool, specifically within the assertPublicHostname handler. This vulnerability allows AI agents to fetch URL content, but the protection mechanism can be bypassed through a DNS rebinding attack. Although the project blocks private IPs and certain domain names, an attacker can exploit the timing between the security check and the actual HTTP request to redirect the request to a private IP, such as AWS metadata services.
Users are advised to upgrade to OpenClaw version 2026.1.29, which addresses the vulnerability by improving the SSRF protection mechanism. The update is available on the OpenClaw GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openclaw/openclaw/ | [email protected] | Product |
| https://github.com/openclaw/openclaw/commit/b623557a2ec7e271bda003eb3ac33fbb2e218505#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR44 | [email protected] | Patch |
| https://github.com/openclaw/openclaw/releases/tag/v2026.1.29 | [email protected] | Release Notes |
| https://github.com/zast-ai/vulnerability-reports/blob/main/openclaw/ssrf.md | [email protected] | ExploitMitigationPatchThird Party Advisory |
| https://vuldb.com/submit/795224 | [email protected] | PatchThird Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/356567 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/356567/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.1.29 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 10, 2026 | New CVE Received | [email protected] |