Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100577OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
Medium 6.3
In plain English
A medium-severity server-side request forgery in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the OpenClaw host.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- GitHub Security Advisory (GHSA-fvxr-9g24-x3hf) vendor-advisory
- VulnCheck Advisory: OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset third-party-advisory