CVE-2026-26324

Katalog CVE

CVSS 7.5 · High EPSS 0,50%

Kerentanan Server-Side Request Forgery (SSRF) pada openclaw. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as `0:0:0:0:0:ffff:7f00:1` (which is `127.0.0.1`). This could allow requests that should be blocked (loopback / private network / link-local metadata) to pass the SSRF guard. Version 2026.2.14 patches the issue.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jrvc-8ff5-2f9f advisory vendor
• https://github.com/openclaw/openclaw/commit/c0c0e0f9aecb913e738742f73e091f2f72d39a19 patch
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 product · release notes