Description

ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-26T14:16:40.040Z",
  "pubdate": "2026-09-26T14:16:40.040Z",
  "executiveSummary": "ClawHub contains a critical Server-Side Request Forgery (SSRF) vulnerability within its public profile image fetching mechanism.\nThe vulnerability arises from improper validation of user-supplied image URLs, allowing attackers to bypass hostname-based blocklists via DNS rebinding techniques.\nBy manipulating the resolution process, an attacker can coerce the backend into performing outbound requests against internal infrastructure or loopback services, circumventing intended network access controls.\nThis flaw affects the ClawHub backend (openclaw/clawhub). Although active exploitation against production internal services was not demonstrated in the research harness, the vulnerability presents a significant risk to internal network security, including the potential for unauthorized access to sensitive metadata endpoints, internal services, or credentials.\nSuccessful exploitation requires the ability to provide an attacker-controlled URL for image processing. The issue is resolved by implementing robust destination pinning to ensure the resolved IP address aligns with the initially validated hostname.",
  "technicalDetails": "The vulnerability resides in the public profile preview functionality of the ClawHub backend, which retrieves and renders remote images based on a user-provided URL. The root cause of the vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) flaw in the network request pipeline.\nThe application initially performs a textual check on the provided hostname against a blocklist of private network ranges. However, this validation is insufficient because the application does not pin the resolved IP address of the destination. Consequently, the system is susceptible to DNS rebinding attacks. An attacker can serve a domain with a very low Time-To-Live (TTL) record; the initial check resolves to a benign public IP, but the subsequent HTTP request resolves the hostname again to an internal address (e.g., 127.0.0.1 or internal metadata services like 169.254.169.254) once the DNS cache expires.\nThe attack flow follows a structured path: First, the attacker provides a malicious URL to the profile image preview. Second, the backend performs a DNS lookup to validate the hostname; the attacker returns a public, non-blocked IP address. Third, the application proceeds to the connection phase, at which point the attacker triggers a DNS rebind. Finally, the backend connects to the target internal host, effectively acting as a proxy for the attacker. Because the validation logic operates on the hostname rather than the resolved network socket, the security boundary is effectively bypassed.\nThis vulnerability was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41. The scope of exploitation is limited to the server-side context; however, it allows an attacker to interact with services reachable from the ClawHub backend that might otherwise be protected by internal firewalls. The issue was addressed in PR #3683, which introduced stricter validation or pinning mechanisms to ensure the destination IP is explicitly verified before the network connection is established. Self-hosted deployments are vulnerable unless they have upgraded to revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 or later."
}