CVE-2026-100576 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or private destinations without navigation checks applied to other browser actions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
OpenClaw versions prior to 2026.8.1 are affected by a server-side request forgery vulnerability located within the logic governing browser wait predicates. This flaw specifically impacts the security controls designed to prevent unauthorized outbound network requests from the application environment. The core issue arises because the SSRF protections, which typically restrict access to internal or loopback addresses and private IP ranges, were not uniformly applied across all browser interaction methods. While standard navigation actions such as loading URLs in a new tab or navigating within an existing session are subject to strict validation checks that block requests to blocked destinations, these safeguards are absent when utilizing the wait function with specific functional arguments.
The technical flaw centers on the implementation of the wait --fn command against an active browser session. When this function is invoked, it allows for asynchronous operations and state polling without triggering the same network request filtering mechanisms applied during explicit navigation events. An attacker who has gained access to a valid OpenClaw instance with control over browser sessions can exploit this inconsistency by crafting requests that utilize the wait predicate to initiate connections to loopback interfaces or private internal networks. Because the application does not validate the destination address in this specific context, the SSRF protections are effectively bypassed, allowing the server to make HTTP requests to addresses it is otherwise configured to block.
The operational impact of this vulnerability is significant for organizations relying on OpenClaw to automate browser tasks while maintaining strict network segmentation and security boundaries. Successful exploitation enables an attacker to perform internal port scanning, access sensitive services running on localhost such as databases or administrative panels that are not exposed externally, and potentially pivot further into the internal network infrastructure. This capability undermines the principle of least privilege by allowing a compromised web application component to act as a proxy for accessing restricted resources. In environments where OpenClaw is deployed within containerized or cloud-native architectures with strict egress filtering, this vulnerability could lead to data exfiltration from internal storage endpoints or unauthorized interaction with microservices that rely on network isolation rather than authentication alone for security.
To mitigate this risk, organizations must upgrade immediately to OpenClaw version 2026.8.1 or later, where the developers have addressed the inconsistency in SSRF validation logic across different browser actions. Until an update is applied, administrators should implement compensating controls at the network level by restricting outbound traffic from hosts running vulnerable versions of OpenClaw using firewall rules that block access to private IP ranges and loopback addresses regardless of application-level filters. Additionally, it is advisable to review logs for unusual patterns involving wait functions or asynchronous browser operations originating from untrusted sources. This vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) as it involves the server making requests on behalf of a user to unintended destinations, and relates to ATT&CK technique T1572 Protocol Tunneling if used to establish covert channels or access internal services through allowed protocols.