CVE-2026-26324: OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)
(updated )
OpenClaw’s SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as 0:0:0:0:0:ffff:7f00:1 (which is 127.0.0.1). This could allow requests that should be blocked (loopback / private network / link-local metadata) to pass the SSRF guard.
- Vulnerable component: SSRF guard (
src/infra/net/ssrf.ts) - Issue type: SSRF protection bypass
References
- github.com/advisories/GHSA-jrvc-8ff5-2f9f
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/c0c0e0f9aecb913e738742f73e091f2f72d39a19
- github.com/openclaw/openclaw/releases/tag/v2026.2.14
- github.com/openclaw/openclaw/security/advisories/GHSA-jrvc-8ff5-2f9f
- nvd.nist.gov/vuln/detail/CVE-2026-26324
Code Behaviors & Features
Detect and mitigate CVE-2026-26324 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →