CVE-2026-100574

Executive Summary

OpenClaw, an npm-distributed package, contains a server-side request forgery (SSRF) vulnerability in its trusted-host DNS validation logic. Versions before 2026.8.1 fail to reject trusted hostnames that resolve to unspecified addresses (0.0.0.0 or ::), allowing a guarded fetch to reach loopback-only services and return their responses. An attacker capable of influencing DNS resolution for an allow-listed hostname can pivot the application's outbound fetch capability toward internal services, with confidentiality impact rated High under CVSS 3.1.

Technical Analysis

The vulnerability class is SSRF (CWE-918), specifically a validation bypass in the destination-checking routine used for "trusted-host DNS rechecks." According to the NVD description, OpenClaw performs a DNS recheck for fetches associated with trusted hosts and validates the resolved destination before permitting the fetch. The validation fails when a trusted hostname resolves to an unspecified address — the IPv4 wildcard/unspecified address 0.0.0.0 or the IPv6 unspecified address ::. These values are not treated as disallowed by the check, so the destination validation is bypassed and the guarded fetch proceeds.

The effective security failure is a class of address-classification gap common to SSRF defenses: blocklists or denylists often enumerate loopback (127.0.0.0/8, ::1), private ranges, and link-local addresses, but omit unspecified addresses. Because 0.0.0.0 is frequently interpreted by operating systems as "bind to all interfaces," and on some stacks an outbound connection attempt to 0.0.0.0 or :: is handled as a connection to a local/loopback destination, the fetch can reach services bound only to loopback. This defeats the intended trust boundary: a hostname that the application believes is "trusted" and DNS-rechecked can be resolved (via attacker-influenced DNS) to an unspecified address, and the subsequent guarded fetch reaches a local-only service and discloses its response.

Attack surface and preconditions:

• The application must perform a fetch that triggers the trusted-host DNS recheck path (as stated, "fetches that use the trusted-host DNS recheck").
• The attacker must be able to influence DNS for an allowed hostname — e.g., by controlling an authoritative DNS zone for a trusted domain, by DNS cache poisoning, or by controlling the resolution path for that hostname.
• A service must be listening on loopback whose response contains data of value.

CVSS 3.1 vector analysis (5.9, Medium):

• AV:N — exploitable over the network; the DNS influence and fetch occur remotely.
• AC:H — the attacker must satisfy DNS influence plus the presence of a trusted hostname and a reachable loopback service; conditions are not trivially met, hence High attack complexity.
• PR:N — no prior authentication is required.
• UI:N — no user interaction is required.
• S:U — the impact remains scoped to the vulnerable component's security authority.
• C:H — the disclosed response from the reachable loopback service can expose sensitive data.
• I:N / A:N — no integrity or availability impact per the vector.

The practical impact is expressly conditioned by NVD: it "depends on the reachable service and the data it returns." There is no public PoC (POC_STATUS: None), no Nuclei template, and no exploit code in the provided data. EPSS has not yet been scored by FIRST.org and is intentionally omitted. CISA KEV: No. This report does not fabricate function names, endpoints, or parameters; none are provided in the NVD description.

Exploitation Scenarios

Because no public PoC exists, the following attack chain is inferred at the vulnerability-class level from the NVD description: "an attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response."

1. Reconnaissance / target identification The attacker identifies an OpenClaw deployment (< 2026.8.1) that performs guarded outbound fetches involving trusted hosts. The attacker determines which hostnames are treated as trusted/allowed (for example, hosts referenced by application configuration or by features that fetch remote resources). The attacker also seeks a means to influence DNS resolution for one of those allowed hostnames.

2. Triggering the flaw class The attacker arranges for an allowed hostname to resolve to an unspecified address (0.0.0.0 or ::). This can be achieved through control of the authoritative DNS records for that hostname (if the attacker has influence over that DNS zone) or through a DNS-influencing position (e.g., cache poisoning or a resolution path the attacker can manipulate). When the application performs the trusted-host DNS recheck, the returned unspecified address is not classified as disallowed, so the SSRF destination validation is bypassed.

3. Payload/execution at the vulnerability-class level No crafted payload is required to trigger the bypass itself; the "payload" is the malicious DNS answer returning 0.0.0.0 or :: for a trusted hostname. The application then issues the guarded fetch to the (mis)validated destination, which the local stack routes to a loopback-bound service rather than to the intended external trusted host.

4. Post-exploitation impact The vulnerable component's fetch reaches a service bound only to loopback and returns its response to the caller/attacker-observable context. Depending on the reachable service, disclosed data may include internal service responses, metadata, or administrative interfaces. There is no integrity or availability impact in the CVSS vector; the objective is information disclosure (C:H). Impact is bounded by what the specific loopback service exposes.

Note: Because the description does not name specific internal endpoints, parameters, or the exact code routine, no implementation-specific details are asserted. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Affected systems: any application or service embedding/operating npm package openclaw at a version below 2026.8.1 that uses the trusted-host DNS recheck for outbound fetches. The blast radius is the set of internal, loopback-bound services reachable through the vulnerable component's fetch path from the host running OpenClaw. This is a confidentiality-only issue per CVSS (C:H, I:N, A:N), scope unchanged (S:U).

Business impact:

• Internal information disclosure: loopback-only services (which are presumed protected by their network position) can be queried indirectly, potentially exposing sensitive responses.
• Trust-boundary erosion: the trusted-host mechanism is designed to constrain where the application may connect; the bypass undermines that control and can be used as a foothold for further SSRF-driven reconnaissance of the local environment.
• The severity is heightened where OpenClaw runs in multi-tenant or shared-hosting contexts, where a low-privilege actor can influence DNS for an allowed host, or where loopback services return sensitive data.

CVSS 5.9 (Medium) reflects the High complexity of arranging DNS influence plus a suitable trusted host and loopback service. However, the confidentiality subscore (C:H) indicates that, when preconditions are met, disclosed data can be significant. With no patch source tracked and patch confidence 0/4, exposure persists for all pre-2026.8.1 deployments until they are updated to 2026.8.1.

Detection Guidance

Sigma Rule

title: OpenClaw SSRF via Trusted-Host DNS Recheck to Unspecified Address (CVE-2026-100574)
id: 5b9c2f1a-0d7e-4c3a-9f21-openclaw100574
status: experimental
description: Detects OpenClaw outbound fetches where a trusted hostname resolves to an unspecified address (0.0.0.0 or ::), indicating the SSRF destination-validation bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100574
author: valtersit.com
date: 2026/01/01
logsource:
  category: dns_query
  product: windows
detection:
  selection_proc:
    Image|endswith: 'node'
    CommandLine|contains: 'openclaw'
  selection_query:
    QueryName|contains: 'openclaw'
  timeframe: 5m
  condition: selection_proc
falsepositives:
  - Legitimate deployments resolving trusted hostnames that intentionally use unspecified addresses
level: medium
tags:
  - attack.t1190
  - cve.2026.100574

YARA Rule

rule CVE_2026_100574_OpenClaw_SSRF_Unspecified_Address
{
    meta:
        description = "Detects OpenClaw artifacts referencing trusted-host DNS recheck logic and unspecified-address handling tied to CVE-2026-100574"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100574"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pkg   = "openclaw" ascii wide nocase
        $dns   = "trusted" ascii wide nocase
        $rechk = "recheck" ascii wide nocase
        $ipv4  = "0.0.0.0" ascii wide
        $ipv6  = "::" ascii wide

    condition:
        $pkg and (($dns and $rechk) or ($ipv4) or ($ipv6))
}

Suricata IDS Rule

alert dns any any -> any any (msg:"CVE-2026-100574 OpenClaw SSRF - trusted hostname resolved to unspecified address (0.0.0.0 / ::)"; dns.query; content:"openclaw"; nocase; pcre:"/(?:\x00\x00\x00\x00|\x00{16})/R"; classtype:attempted-recon; reference:cve,2026-100574; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100574; sid:2026100574; rev:1;)

Elastic Detection

dns where process.name == "node" and dns.question.name : "openclaw*" and (
  dns.resolved_ip == "0.0.0.0" or dns.resolved_ip == "::"
)

Splunk SPL Query

index=dns OR index=network sourcetype=*dns*
| search (process="node" OR process_name="node") (query="*openclaw*")
| eval is_bad=if(resolved_ip="0.0.0.0" OR resolved_ip="::" OR answer="0.0.0.0" OR answer="::",1,0)
| where is_bad=1
| table _time, host, process, query, resolved_ip, answer
| sort - _time

Wazuh OSSEC Rule

<group name="openclaw,ssrf,cve-2026-100574,">
  <rule id="100574" level="10">
    <decoded_as>json</decoded_as>
    <field name="query">\.openclaw</field>
    <field name="resolved_ip">0\.0\.0\.0|::</field>
    <description>CVE-2026-100574: OpenClaw trusted host resolved to unspecified address (0.0.0.0/::) - possible SSRF validation bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,cve_2026_100574,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Upgrade to OpenClaw 2026.8.1 or later. The NVD description states the vulnerability is fixed in 2026.8.1; this is the primary remediation, but note no vendor advisory, commit, or patch source is tracked (0/4 confidence), so independently verify the fix on your deployed build.
• Where upgrade is not immediately possible, restrict outbound fetch capability at the network layer: deny egress the vulnerable process can use to reach loopback/unspecified destinations, and apply egress allow-listing so the application can reach only explicitly intended external hosts.
• Harden DNS: prevent untrusted parties from influencing resolution of trusted hostnames (e.g., pin authoritative resolvers, enable DNSSEC where supported, monitor for anomalous DNS answers returning 0.0.0.0 or :: for trusted names).
• Reduce the attack surface of loopback services: bind internal administrative/management services to Unix domain sockets where feasible, require authentication and mutual TLS, and avoid returning sensitive data to unauthenticated local callers.

2. Patch / upgrade steps

• Identify all deployments of npm package openclaw and confirm version. Any version < 2026.8.1 is presumed affected.
• Update the package to 2026.8.1 or later through your dependency-management process; rebuild/redeploy dependent applications.
• After upgrade, validate that the trusted-host DNS recheck now rejects unspecified addresses (0.0.0.0 and ::) by testing resolution of an allowed hostname to those values in a controlled staging environment.

3. Long-term hardening

• Treat SSRF defense as an address-classification problem: reject unspecified, loopback, private, link-local, and reserved ranges for both IPv4 and IPv6, and apply the check to every resolved address (not a single answer).
• Guard against DNS rebinding by validating the IP actually connected to, and by enforcing allow-lists at connect time rather than only at URL-parse time.
• Institute continuous dependency scanning for npm packages and track advisories; since no patch source is currently tracked, monitor upstream OpenClaw releases and NVD for updates.
• Apply least privilege and network segmentation so a successful SSRF yields minimal reachable data.

References

• NVD — CVE-2026-100574: https://nvd.nist.gov/vuln/detail/CVE-2026-100574
• CWE-918: Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OpenClaw npm package: https://www.npmjs.com/package/openclaw
• FIRST EPSS: not yet scored for CVE-2026-100574 as of this report (no value assigned); CISA KEV: not listed. No known threat actor campaigns or exploit-in-the-wild evidence are available in the provided data; no public PoC, Nuclei template, or exploit code exists at time of writing.