Описание
OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to special-use IPv4 ranges can exploit web_fetch functionality to access blocked addresses such as 198.18.0.0/15 and other non-global ranges.
Ссылки
- Patch
- Patch
- Patch
- Patch
- Vendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2026.2.22 (исключая)
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 11%
0.00206
Низкий
7.4 High
CVSS3
5.3 Medium
CVSS3
Дефекты
CWE-918
Связанные уязвимости
CVSS3: 5.3
github
7 месяцев назад
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
EPSS
Процентиль: 11%
0.00206
Низкий
7.4 High
CVSS3
5.3 Medium
CVSS3
Дефекты
CWE-918