CVE-2026-100567 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports performed a later, independent DNS resolution, discarding the DNS pinning enforced at validation time. An attacker who controls an approved CDP hostname or its DNS answers can exploit this check-then-use gap via DNS rebinding to make the Gateway connect to a loopback, private, link-local, cloud metadata, or other SSRF-policy-denied address. The impact depends on the remote CDP configuration, DNS timing, and the services reachable from the Gateway host. The issue is fixed in 2026.8.1; as a mitigation, disable hostname-based remote CDP endpoints or restrict them to trusted, stable infrastructure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within OpenClaw versions greater than or equal to 2026.4.5 and less than 2026.8.1 represents a critical check-then-use race condition rooted in inconsistent DNS resolution handling across different transport layers. As an agent gateway, OpenClaw is designed to facilitate communication between AI agents and remote services via the Chrome DevTools Protocol (CDP). The security architecture initially attempts to mitigate risks by validating the hostname of the configured remote CDP endpoint against a single DNS resolution result at configuration time or during initial connection setup. This validation step is intended to enforce DNS pinning, ensuring that the gateway connects only to the specific IP address associated with the trusted domain name provided by the administrator. However, this security control was not uniformly applied across all communication pathways within the application.
The core technical flaw lies in the discrepancy between how different transport mechanisms handle network resolution. While the initial validation phase correctly resolves and pins the DNS record for the approved CDP hostname, the underlying raw WebSocket and Playwright transports perform their own independent DNS resolutions at the moment of actual data transmission or connection establishment. This architectural oversight means that the security check performed earlier is effectively bypassed during runtime operations. By discarding the previously enforced DNS pinning, these transport layers introduce a window of opportunity for attackers to manipulate network routing through DNS rebinding attacks. In such an attack scenario, an adversary who controls the approved CDP hostname or can influence its DNS answers can alter the IP address returned by the Domain Name System between the initial validation and the subsequent connection attempt.
This vulnerability enables Server-Side Request Forgery (SSRF) scenarios with significant potential for internal network compromise. Because the gateway performs a new resolution at runtime, an attacker can configure their controlled domain to initially resolve to a legitimate public IP address that passes the security check, but then rapidly change the DNS record to point toward sensitive internal addresses upon connection initiation. This allows the OpenClaw gateway to be tricked into connecting to loopback interfaces (127.0.0.1), private network ranges (such as 192.168.x.x or 10.x.x.x), link-local addresses, or cloud metadata endpoints like AWS Instance Metadata Service (IMDS). The impact of this exploitation is heavily dependent on the specific remote CDP configuration and the services accessible from the gateway host environment. If internal administrative interfaces, database ports, or sensitive API endpoints are reachable without additional authentication layers, an attacker could potentially exfiltrate data, modify configurations, or achieve further lateral movement within the network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-384 Session Fixation concepts related to DNS rebinding, as well as ATT&CK technique T1557 Adversary-in-the-Middle where an attacker intercepts or redirects communication channels. The failure to maintain consistent state across different components of the application violates fundamental principles of secure software design regarding context preservation during network operations. It highlights the danger of relying on single-point validations in distributed systems where multiple layers may interact asynchronously with external resources.
The issue has been addressed in version 2026.8.1, which presumably enforces consistent DNS resolution and pinning across all transport mechanisms including WebSocket and Playwright connections. For organizations unable to immediately upgrade, mitigation strategies should focus on reducing the attack surface by disabling hostname-based remote CDP endpoints entirely if they are not strictly necessary for operational requirements. If such endpoints must remain enabled, it is critical to restrict them exclusively to trusted, stable infrastructure with static IP addresses that do not rely on dynamic DNS resolution. Additionally, implementing network-level controls such as firewall rules or egress filtering can provide a secondary layer of defense by preventing the gateway from initiating connections to internal private ranges or cloud metadata services regardless of how the hostname resolves. Regular auditing of CDP configurations and monitoring for unusual outbound connection patterns originating from the OpenClaw process are also recommended practices to detect potential exploitation attempts in real-time.