CVE-2026-100577CWE-918ssrf

CVE-2026-100577

Medium · published September 26, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the OpenClaw host.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-26T07:17Z
References (2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf · [email protected]https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-server-side-request-forgery-via-video-asset · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 02:19Z
    OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
    cvelistv5