GHSA-g86v-f9qv-rh6m | openclaw/openclaw Security vulnerabilities | GitStock

GHSA ID: GHSA-g86v-f9qv-rh6m
Severity: low
Published: 2026-03-31T23:58:43Z
Updated: 2026-03-31T23:58:44Z
CVSS: 3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3: 3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Summary

The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed.

Impact

An attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard.

Affected Component

src/shared/net/ip.ts, src/infra/net/ssrf.*

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit d61f8e5672 (Net: block missing IPv6 special-use ranges).

OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.

CWEs

CWE-918 · Server-Side Request Forgery (SSRF)

References