CVE-2026-100574

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.8.1

Description A server-side request forgery (SSRF) issue exists in the trusted-host DNS checks. When fetches utilize the trusted-host DNS recheck, a trusted hostname resolving to an unspecified address (0.0.0.0 or ::) can bypass destination validation. This allows an attacker capable of influencing DNS for an allowed hostname to direct a guarded fetch to a service bound only to the loopback interface, potentially disclosing the service response.

Recommendations Update openclaw to version 2026.8.1.