CVE-2026-100601 in ClawHub
Summary
by MITRE • 09/26/2026
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The ClawHub application backend contains a server-side request forgery vulnerability within the public profile preview functionality, specifically during image fetching operations. This security flaw arises from an insufficient validation mechanism when processing user-supplied image URLs. The system attempts to mitigate risk by checking the textual hostname against patterns associated with private address ranges; however, this approach relies solely on static string matching of the domain name rather than validating the actual network destination after resolution. Consequently, attackers can exploit DNS rebinding techniques where a public-looking hostname is configured to resolve to an internal IP address at the time of connection, bypassing the initial textual check. This discrepancy between validation and execution allows malicious actors to force the server to make requests to internal services that are otherwise inaccessible from the external network.
The operational impact of this vulnerability includes unauthorized outbound connections to attacker-controlled endpoints or internal infrastructure. In a controlled demonstration by maintainers using a local harness, an outbound connection was successfully established to a loopback listener owned by the tester. While critical outcomes such as access to production internal services, credential disclosure, and remote code execution were not demonstrated in this specific instance, the underlying mechanism poses significant risks. Successful exploitation could potentially lead to data exfiltration from internal networks, unauthorized interaction with backend APIs, or further pivoting into more sensitive parts of the infrastructure depending on the deployment context and network segmentation policies.
This vulnerability aligns with Common Weakness Enumeration CWE-918 Server-Side Request Forgery (SSRF), particularly involving DNS rebinding attacks where hostname validation is insufficient without IP address verification at connection time. From a cybersecurity framework perspective, this relates to MITRE ATT&CK technique T1557 Adversary-in-the-Middle or potentially T1046 Network Service Discovery if used for internal reconnaissance. The lack of strict destination pinning and the reliance on textual hostname checks represent classic implementation errors in SSRF mitigation strategies that fail to account for dynamic DNS resolution behaviors.
The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, though the complete historical range of affected versions has not been fully established. A fix was implemented via pull request #3683 and included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on September 11, 2026. Organizations running self-hosted deployments of ClawHub must update their instances to this revision or any later descendant to mitigate the risk. It is important to note that the npm CLI and OpenClaw runtime are separate products and remain unaffected by this specific vulnerability in the ClawHub backend service.