CVE-2026-100601

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100601
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100601.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100601
Aliases
  • GHSA-48gp-hx8w-wjvm
Published
2026-09-26T13:22:46Z
Modified
2026-09-30T03:30:23Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L CVSS Calculator
Summary
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Details

ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolved network destination, so a public-looking hostname can resolve to an internal address or change resolution between validation and connection (DNS rebinding). A maintainer-run local harness demonstrated an outbound connection to an owner-controlled loopback listener; access to production internal services, credential disclosure, and code execution were not demonstrated. The issue was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41; the complete historical affected range was not established. Fixed by PR #3683, included in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650, which was deployed to clawhub.ai on 2026-09-11; self-hosted deployments should update to that revision or a later descendant. The npm CLI and OpenClaw runtime are separate products and are not affected.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100601.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/openclaw/clawhub

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/clawhub
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

Other
deploy/prod/20260502-194322Z-3aff30b
deploy/prod/20260502-194409Z-e4aa4c7
deploy/prod/20260502-194452Z-6d4cf0c
deploy/prod/20260502-200724Z-3c09df3
deploy/prod/20260502-200930Z-f2a61c9
deploy/prod/20260502-230014Z-8234c92
deploy/prod/20260503-055722Z-46354c9
deploy/prod/20260503-200652Z-768a501
deploy/prod/20260506-061139Z-32011a1
deploy/prod/20260506-062151Z-57308e6
deploy/prod/20260506-190528Z-5aa4d13
deploy/prod/20260506-191420Z-8d5eb14
deploy/prod/20260506-201213Z-bec9362
deploy/prod/20260506-211420Z-678935d
deploy/prod/20260506-211928Z-e8deec1
deploy/prod/20260507-001319Z-e629357
deploy/prod/20260507-003309Z-5019f2a
deploy/prod/20260507-024951Z-5e7797d
deploy/prod/20260509-085801Z-b6875e6
deploy/prod/20260509-114209Z-ceb2561
deploy/prod/20260509-124815Z-227cce1
deploy/prod/20260509-125130Z-da20972
deploy/prod/20260509-134242Z-8bd7be9
deploy/prod/20260509-135556Z-40627f0
deploy/prod/20260509-224311Z-4cfc137
deploy/prod/20260510-010329Z-edba7e1
deploy/prod/20260510-010750Z-49d77c0
deploy/prod/20260510-011225Z-3832305
deploy/prod/20260510-015432Z-3a6ab49
deploy/prod/20260510-042607Z-003d243
deploy/prod/20260510-055252Z-3b80e3f
deploy/prod/20260510-090040Z-c2c0130
deploy/prod/20260510-090717Z-92f5e68
deploy/prod/20260510-153112Z-3d934a5
deploy/prod/20260510-154121Z-2dcaf25
deploy/prod/20260511-003126Z-5d0264d
deploy/prod/20260511-074627Z-3173ecd
deploy/prod/20260511-132333Z-8287c49
deploy/prod/20260511-133638Z-a873ffb
deploy/prod/20260511-134807Z-3d021d3
deploy/prod/20260511-135611Z-bac981a
deploy/prod/20260511-150131Z-bb6c6c1
deploy/prod/20260511-211840Z-c51cfe2
deploy/prod/20260511-214020Z-008af4d
deploy/prod/20260511-224345Z-c1257a3
deploy/prod/20260511-225702Z-3b2d3dc
deploy/prod/20260511-232941Z-0c4d044
deploy/prod/20260512-000455Z-b80b942
deploy/prod/20260512-001645Z-53b64d1
deploy/prod/20260512-071923Z-dded7a5
deploy/prod/20260512-202256Z-af96221
deploy/prod/20260513-040344Z-f0a6789
deploy/prod/20260513-050836Z-72d4e7a
deploy/prod/20260513-073557Z-6c15a48
deploy/prod/20260513-095829Z-2763be8
deploy/prod/20260513-165224Z-a1666bb
deploy/prod/20260513-211620Z-a116d92
deploy/prod/20260513-223957Z-893f341
deploy/prod/20260513-225132Z-22e994f
deploy/prod/20260514-172640Z-cccef81
deploy/prod/20260514-182213Z-9ab92e5
deploy/prod/20260518-001045Z-636750f
deploy/prod/20260518-011348Z-35aa372
deploy/prod/20260518-233609Z-6814af9
deploy/prod/20260519-000431Z-583a48d
deploy/prod/20260519-010819Z-27f0b7d
deploy/prod/20260519-014538Z-66f3d07
deploy/prod/20260519-052642Z-4851f5f
deploy/prod/20260519-055850Z-c7935b6
deploy/prod/20260519-211813Z-0b888a2
deploy/prod/20260519-215421Z-b753b1f
deploy/prod/20260520-042436Z-3c45326
deploy/prod/20260520-050845Z-9be35a3
deploy/prod/20260520-224859Z-4e4d5c8
deploy/prod/20260521-030021Z-3910790
deploy/prod/20260521-152320Z-b07196f
deploy/prod/20260522-192443Z-e22bb7d
deploy/prod/20260522-194628Z-afd7326
deploy/prod/20260522-203624Z-0907fae
deploy/prod/20260523-185254Z-c145166
deploy/prod/20260523-223623Z-c538848
deploy/prod/20260523-234514Z-2ad4068
deploy/prod/20260524-004843Z-6a3c855
deploy/prod/20260524-015922Z-963b0a5
deploy/prod/20260525-230418Z-0194686
deploy/prod/20260525-235528Z-b62d8ca
deploy/prod/20260526-133223Z-90de729
deploy/prod/20260526-171147Z-667bc55
deploy/prod/20260527-170544Z-5ed0ddd
deploy/prod/20260527-172940Z-30bf8f2
deploy/prod/20260527-190912Z-57bc9f2
deploy/prod/20260527-195325Z-a920323
deploy/prod/20260527-223753Z-7d6efae
deploy/prod/20260528-141734Z-0132f1f
deploy/prod/20260528-153448Z-51967bc
deploy/prod/20260529-123902Z-cbbb6e7
deploy/prod/20260529-124423Z-b292f7e
deploy/prod/20260529-142403Z-23932ec
deploy/prod/20260529-184927Z-1f7f483
deploy/prod/20260529-200948Z-f71139e
deploy/prod/20260529-211834Z-4c965f4
deploy/prod/20260530-053946Z-9a20795
deploy/prod/20260530-171429Z-9aa3f37
deploy/prod/20260601-222719Z-01aa28c
deploy/prod/20260603-052159Z-0a79612
deploy/prod/20260603-072634Z-953358a
deploy/prod/20260603-214852Z-162528a
deploy/prod/20260604-231317Z-3fbe275
deploy/prod/20260605-012338Z-9cf9e12
deploy/prod/20260605-014234Z-7cd0ef3
deploy/prod/20260605-015059Z-1c8543a
deploy/prod/20260605-021742Z-fe4acc8
deploy/prod/20260605-032359Z-1a968d8
deploy/prod/20260605-040520Z-2d719fe
deploy/prod/20260605-215502Z-94ded18
deploy/prod/20260606-001730Z-8ebae39
deploy/prod/20260606-003339Z-d2525b1
deploy/prod/20260606-212428Z-9ce5e70
deploy/prod/20260606-215647Z-3ead985
deploy/prod/20260606-230930Z-999131e
deploy/prod/20260606-235826Z-8e1bad4
deploy/prod/20260608-033043Z-5c19da4
deploy/prod/20260608-055419Z-1fa4f90
deploy/prod/20260609-024445Z-be70ae5
deploy/prod/20260609-043208Z-89a89af
deploy/prod/20260609-222245Z-741599d
deploy/prod/20260610-035941Z-0724abc
deploy/prod/20260610-041125Z-e9571f3
deploy/prod/20260611-174907Z-2c9aa36
deploy/prod/20260612-001558Z-a1becd0
deploy/prod/20260612-233433Z-4b3c2bb
deploy/prod/20260613-213144Z-6820029
deploy/prod/20260613-213911Z-749028d
deploy/prod/20260613-224114Z-6afb91b
deploy/prod/20260614-203106Z-9ef3372
deploy/prod/20260614-230744Z-fdb4d31
deploy/prod/20260614-234854Z-b8ec008
deploy/prod/20260615-015847Z-03f9734
deploy/prod/20260615-034504Z-2293016
deploy/prod/20260615-061547Z-078d1c8
deploy/prod/20260615-163058Z-078425f
deploy/prod/20260615-163736Z-bb35aca
deploy/prod/20260615-180858Z-44ce895
deploy/prod/20260616-003524Z-89bb8fe
deploy/prod/20260616-003912Z-76638de
deploy/prod/20260616-005639Z-f366269
deploy/prod/20260616-011128Z-44f4ab0
deploy/prod/20260616-012408Z-69dd3b5
deploy/prod/20260616-030357Z-9115151
deploy/prod/20260616-030716Z-1b66b84
deploy/prod/20260616-150722Z-303075c
deploy/prod/20260616-153434Z-0e20d64
deploy/prod/20260617-000550Z-1e7de4a
deploy/prod/20260617-004422Z-4860945
deploy/prod/20260617-223349Z-11ad31a
deploy/prod/20260618-003024Z-2d93401
deploy/prod/20260618-010039Z-4bc58e4
deploy/prod/20260619-022924Z-1cac1b2
deploy/prod/20260619-204507Z-7accfb7
deploy/prod/20260619-220702Z-0f5496f
deploy/prod/20260620-003154Z-ea0125d
deploy/prod/20260620-023700Z-3836b76
deploy/prod/20260620-025932Z-6f28659
deploy/prod/20260622-005610Z-a86c48c
deploy/prod/20260622-043054Z-379c187
deploy/prod/20260622-071034Z-39d03a5
deploy/prod/20260623-044751Z-917fb3f
deploy/prod/20260623-053803Z-4a78ca3
deploy/prod/20260623-083226Z-94f2f53
deploy/prod/20260623-090710Z-6aab4f9
deploy/prod/20260623-095920Z-9b352d7
deploy/prod/20260623-183838Z-9b352d7
deploy/prod/20260623-221214Z-cc3fc61
deploy/prod/20260624-005758Z-32aa234
deploy/prod/20260624-020611Z-35f6d34
deploy/prod/20260624-042809Z-d3fa80c
deploy/prod/20260624-065233Z-2bf8113
deploy/prod/20260624-130548Z-fa222d4
deploy/prod/20260625-043053Z-e337136
deploy/prod/20260625-045900Z-8e7c8d4
deploy/prod/20260625-050530Z-d1716c6
deploy/prod/20260625-052841Z-843cf78
deploy/prod/20260625-063545Z-b5d1371
deploy/prod/20260625-074836Z-164959d
deploy/prod/20260625-081134Z-8e56a9f
deploy/prod/20260626-085018Z-a954bef
deploy/prod/20260626-231028Z-ce5455b
deploy/prod/20260627-003357Z-447a5b0
deploy/prod/20260627-142305Z-67b7403
deploy/prod/20260627-143554Z-18dac69
deploy/prod/20260627-160402Z-bdb23c3
deploy/prod/20260629-234306Z-aa5952e
deploy/prod/20260630-021601Z-a230d96
deploy/prod/20260630-024808Z-ab8e3b1
deploy/prod/20260630-052036Z-919f047
deploy/prod/20260702-151139Z-a89bfaf
deploy/prod/20260703-041442Z-3ce0ce4
deploy/prod/20260703-112333Z-9ff6fce
deploy/prod/20260706-113033Z-77c6671
deploy/prod/20260706-170529Z-2651570
deploy/prod/20260706-172312Z-1166a37
deploy/prod/20260706-173036Z-de19a6b
deploy/prod/20260706-205827Z-07e542f
deploy/prod/20260707-004945Z-fe7aab3
deploy/prod/20260707-234719Z-725af4e
deploy/prod/20260708-034250Z-6d27f3c
deploy/prod/20260709-035640Z-dfca6f5
deploy/prod/20260709-180850Z-de29369
deploy/prod/20260710-022008Z-2191194
deploy/prod/20260716-184139Z-b23d10d
deploy/prod/20260717-001110Z-97905c8
deploy/prod/20260717-003550Z-43e44a8
deploy/prod/20260717-185753Z-8142b35
deploy/prod/20260718-011339Z-af3d01c
deploy/prod/20260718-015627Z-db3b3fe
deploy/prod/20260720-072327Z-ed9c8fd
deploy/prod/20260720-230649Z-3097319
deploy/prod/20260721-023642Z-a68f707
deploy/prod/20260721-041248Z-8a8e692
deploy/prod/20260721-054036Z-723f155
deploy/prod/20260722-033423Z-7ef2b15
deploy/prod/20260722-050654Z-eb47a7c
deploy/prod/20260723-181221Z-eb3050f
deploy/prod/20260724-203241Z-ead9d94
deploy/prod/20260724-233949Z-fd61062
deploy/prod/20260726-174207Z-010c87f
deploy/prod/20260726-194300Z-c918f9f
deploy/prod/20260730-174302Z-70ce492
deploy/prod/20260802-053000Z-3d3ac29
deploy/prod/20260819-052709Z-d6ed957
deploy/prod/20260819-065811Z-bfb760d
deploy/prod/20260827-205813Z-efc565c
deploy/prod/20260831-042114Z-1643653
deploy/prod/20260831-175044Z-e2a82b3
deploy/prod/20260902-002915Z-251ef76
deploy/prod/20260902-114415Z-d405470
deploy/prod/20260904-232140Z-ba5eb72
deploy/prod/20260909-052907Z-494c348
gh-attach-assets
prod/v2026.*
prod/v2026.05.02.1
prod/v2026.05.02.2
prod/v2026.05.02.3
prod/v2026.05.02.4
prod/v2026.05.02.5
prod/v2026.05.02.6
prod/v2026.05.03.1
prod/v2026.05.03.2
prod/v2026.05.06.1
prod/v2026.05.06.2
prod/v2026.05.06.3
prod/v2026.05.06.4
prod/v2026.05.06.5
prod/v2026.05.06.6
prod/v2026.05.06.7
prod/v2026.05.07.1
prod/v2026.05.07.2
prod/v2026.05.07.3
prod/v2026.05.09.1
prod/v2026.05.09.2
prod/v2026.05.09.3
prod/v2026.05.09.4
prod/v2026.05.09.5
prod/v2026.05.09.6
prod/v2026.05.09.7
prod/v2026.05.10.1
prod/v2026.05.10.10
prod/v2026.05.10.2
prod/v2026.05.10.3
prod/v2026.05.10.4
prod/v2026.05.10.5
prod/v2026.05.10.6
prod/v2026.05.10.7
prod/v2026.05.10.8
prod/v2026.05.10.9
prod/v2026.05.11.1
prod/v2026.05.11.10
prod/v2026.05.11.11
prod/v2026.05.11.12
prod/v2026.05.11.2
prod/v2026.05.11.3
prod/v2026.05.11.4
prod/v2026.05.11.5
prod/v2026.05.11.6
prod/v2026.05.11.7
prod/v2026.05.11.8
prod/v2026.05.11.9
prod/v2026.05.12.1
prod/v2026.05.12.2
prod/v2026.05.12.3
prod/v2026.05.12.4
prod/v2026.05.13.1
prod/v2026.05.13.2
prod/v2026.05.13.3
prod/v2026.05.13.4
prod/v2026.05.13.5
prod/v2026.05.13.6
prod/v2026.05.13.7
prod/v2026.05.13.8
prod/v2026.05.14.1
prod/v2026.05.14.2
prod/v2026.05.18.1
prod/v2026.05.18.2
prod/v2026.05.18.3
prod/v2026.05.19.1
prod/v2026.05.19.2
prod/v2026.05.19.3
prod/v2026.05.19.4
prod/v2026.05.19.5
prod/v2026.05.19.6
prod/v2026.05.19.7
prod/v2026.05.20.1
prod/v2026.05.20.2
prod/v2026.05.20.3
prod/v2026.05.21.1
prod/v2026.05.21.2
prod/v2026.05.22.1
prod/v2026.05.22.2
prod/v2026.05.22.3
prod/v2026.05.23.1
prod/v2026.05.23.2
prod/v2026.05.23.3
prod/v2026.05.24.1
prod/v2026.05.24.2
prod/v2026.05.25.1
prod/v2026.05.25.2
prod/v2026.05.26.1
prod/v2026.05.26.2
prod/v2026.05.27.1
prod/v2026.05.27.2
prod/v2026.05.27.3
prod/v2026.05.27.4
prod/v2026.05.27.5
prod/v2026.05.28.1
prod/v2026.05.28.2
prod/v2026.05.29.1
prod/v2026.05.29.2
prod/v2026.05.29.3
prod/v2026.05.29.4
prod/v2026.05.29.5
prod/v2026.05.29.6
prod/v2026.05.30.1
prod/v2026.05.30.2
prod/v2026.06.01.1
prod/v2026.06.03.1
prod/v2026.06.03.2
prod/v2026.06.03.3
prod/v2026.06.04.1
prod/v2026.06.05.1
prod/v2026.06.05.2
prod/v2026.06.05.3
prod/v2026.06.05.4
prod/v2026.06.05.5
prod/v2026.06.05.6
prod/v2026.06.05.7
prod/v2026.06.06.1
prod/v2026.06.06.2
prod/v2026.06.06.3
prod/v2026.06.06.4
prod/v2026.06.06.5
prod/v2026.06.06.6
prod/v2026.06.08.1
prod/v2026.06.08.2
prod/v2026.06.09.1
prod/v2026.06.09.2
prod/v2026.06.09.3
prod/v2026.06.10.1
prod/v2026.06.10.2
prod/v2026.06.11.1
prod/v2026.06.12.1
prod/v2026.06.12.2
prod/v2026.06.13.1
prod/v2026.06.13.2
prod/v2026.06.13.3
prod/v2026.06.14.1
prod/v2026.06.14.2
prod/v2026.06.14.3
prod/v2026.06.15.1
prod/v2026.06.15.2
prod/v2026.06.15.3
prod/v2026.06.15.4
prod/v2026.06.15.5
prod/v2026.06.15.6
prod/v2026.06.16.1
prod/v2026.06.16.2
prod/v2026.06.16.3
prod/v2026.06.16.4
prod/v2026.06.16.5
prod/v2026.06.16.6
prod/v2026.06.16.7
prod/v2026.06.16.8
prod/v2026.06.16.9
prod/v2026.06.17.1
prod/v2026.06.17.2
prod/v2026.06.17.3
prod/v2026.06.18.1
prod/v2026.06.18.2
prod/v2026.06.19.1
prod/v2026.06.19.2
prod/v2026.06.19.3
prod/v2026.06.20.1
prod/v2026.06.20.2
prod/v2026.06.20.3
prod/v2026.06.22.1
prod/v2026.06.22.2
prod/v2026.06.22.3
prod/v2026.06.23.1
prod/v2026.06.23.2
prod/v2026.06.23.3
prod/v2026.06.23.4
prod/v2026.06.23.5
prod/v2026.06.23.6
prod/v2026.06.23.7
prod/v2026.06.24.1
prod/v2026.06.24.2
prod/v2026.06.24.3
prod/v2026.06.24.4
prod/v2026.06.24.5
prod/v2026.06.25.1
prod/v2026.06.25.2
prod/v2026.06.25.3
prod/v2026.06.25.4
prod/v2026.06.25.5
prod/v2026.06.25.6
prod/v2026.06.25.7
prod/v2026.06.26.1
prod/v2026.06.26.2
prod/v2026.06.27.1
prod/v2026.06.27.2
prod/v2026.06.27.3
prod/v2026.06.27.4
prod/v2026.06.29.1
prod/v2026.06.30.1
prod/v2026.06.30.2
prod/v2026.06.30.3
prod/v2026.07.02.1
prod/v2026.07.03.1
prod/v2026.07.03.2
prod/v2026.07.06.1
prod/v2026.07.06.2
prod/v2026.07.06.3
prod/v2026.07.06.4
prod/v2026.07.06.5
prod/v2026.07.07.1
prod/v2026.07.07.2
prod/v2026.07.08.1
prod/v2026.07.09.1
prod/v2026.07.09.2
prod/v2026.07.10.1
prod/v2026.07.16.1
prod/v2026.07.17.1
prod/v2026.07.17.2
prod/v2026.07.17.3
prod/v2026.07.18.1
prod/v2026.07.18.2
prod/v2026.07.20.1
prod/v2026.07.20.2
prod/v2026.07.21.1
prod/v2026.07.21.2
prod/v2026.07.21.3
prod/v2026.07.22.1
prod/v2026.07.22.2
prod/v2026.07.23.1
prod/v2026.07.24.1
prod/v2026.07.24.2
prod/v2026.07.26.1
prod/v2026.07.26.2
prod/v2026.07.30.1
prod/v2026.08.02.1
prod/v2026.08.19.1
prod/v2026.08.19.2
prod/v2026.08.27.1
prod/v2026.08.31.1
prod/v2026.08.31.2
prod/v2026.09.02.1
prod/v2026.09.02.2
prod/v2026.09.04.1
prod/v2026.09.09.1
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.11.0
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.19.1
v0.19.2
v0.2.0
v0.20.0
v0.20.2
v0.21.0
v0.22.0
v0.23.0
v0.23.1
v0.23.2
v0.23.3
v0.3.0
v0.3.1-beta.1
v0.5.0
v0.6.0
v0.6.1
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100601.json"