CVE-2026-22181CWE-918

OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch

Medium · published March 18, 2026

CVSS v4.0
6.1
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy variables are configured. When HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are present, attacker-influenced URLs can be routed through proxy behavior instead of pinned-destination routing, enabling access to internal targets reachable from the proxy environment.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00230 · 13.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-18T01:34Z
EPSS history
Timeline
  • 18 MAR 01:34Z
    OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch
    cvelistv5