PT-2026-31871 · Openclaw · Openclaw

Zast.Ai · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-6011

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions through 2026.1.26

Description A weakness exists in OpenClaw up to version 2026.1.26, specifically within the assertPublicHostname Handler functionality of the file src/agents/tools/web-fetch.ts. A manipulation can lead to server-side request forgery. The attack can be executed remotely and is characterized by high complexity, though exploitation is known to be difficult. The exploit has been made publicly available.

Recommendations Upgrade to version 2026.1.29 or later, which includes the patch b623557a2ec7e271bda003eb3ac33fbb2e218505. Upgrade the affected component.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6011

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/zast-ai/vulnerability-reports/blob/main/openclaw/ssrf.md · Exploit
• https://github.com/openclaw/openclaw/releases/tag/v2026.1.29 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6011 · Security Note
• https://github.com/openclaw/openclaw/commit/b623557a2ec7e271bda003eb3ac33fbb2e218505#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR44 · Patch
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2042495210626650213 · Twitter Post
• https://twitter.com/CVEnew/status/2042561766736171290 · Twitter Post
• https://vuldb.com/submit/795224 · Note
• https://vuldb.com/vuln/356567/cti · Note
• https://vuldb.com/vuln/356567 · Note