CVE-2026-100567

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.5 through 2026.8.0

Description The Gateway validates a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports perform a subsequent, independent DNS resolution. This creates a check-then-use gap that allows an attacker controlling an approved CDP hostname or its DNS answers to use DNS rebinding—a technique used to bypass Same-Origin Policy by changing DNS records between requests—to force the Gateway to connect to loopback, private, link-local, cloud metadata, or other SSRF-policy-denied addresses. Server-Side Request Forgery (SSRF) is a vulnerability where an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update to version 2026.8.1. Disable hostname-based remote CDP endpoints. Restrict remote CDP endpoints to trusted, stable infrastructure.