CVE-2026-100601

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650

Description The application backend contains a server-side request forgery (SSRF) issue within the public profile preview image fetching process. The system accepts a user-supplied image URL and verifies the hostname against private-address patterns; however, it fails to validate or pin the resolved network destination. This allows a public-looking hostname to resolve to an internal address or change its resolution between the validation and connection phases, a technique known as DNS rebinding (where a DNS server is configured to return a safe IP first and then a malicious internal IP). A local test demonstrated an outbound connection to a loopback listener.

Recommendations Update to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or a later descendant.