← Back to the live CVE advisory feed

CVE-2026-100567: Product identification pending

Severity

8.9 (HIGH)

Affected versions

>= 2026

Fixed version

2026.8.1

Patch status

Patched

Published

2026-09-26T03:17:03.737

Modified

2026-09-26T03:17:03.737

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports performed a later, independent DNS resolution, discarding the DNS pinning enforced at validation time. An attacker who controls an approved CDP hostname or its DNS answers can exploit this check-then-use gap via DNS rebinding to make the Gateway connect to a loopback, private, link-local, cloud metadata, or other SSRF-policy-denied address. The impact depends on the remote CDP configuration, DNS timing, and the services reachable from the Gateway host. The issue is fixed in 2026.8.1; as a mitigation, disable hostname-based remote CDP endpoints or restrict them to trusted, stable infrastructure.

View the official NVD record for CVE-2026-100567

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.