GHSA-8cp7-rp8r-mg77: OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP

March 4, 2026

OpenClaw’s SSRF hostname/IP guard did not detect ISATAP embedded IPv4 addresses (...:5efe:w.x.y.z). A crafted URL containing an ISATAP IPv6 literal could embed a private IPv4 target (for example loopback) and bypass private-address filtering in URL-fetching paths.

References

github.com/advisories/GHSA-8cp7-rp8r-mg77
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/d51929ecb52fe65e90bf36795f4247feb29eb8aa
github.com/openclaw/openclaw/security/advisories/GHSA-8cp7-rp8r-mg77

Code Behaviors & Features

Detect and mitigate GHSA-8cp7-rp8r-mg77 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →