CVE-2026-32019
mediumpriority · track · 21EPSS 0.002 · 12 %ileDEEUUSEPSS · scored 2026-10-27
OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to special-use IPv4 ranges can exploit web_fetch functionality to access blocked addresses such as 198.18.0.0/15 and other non-global ranges.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 0.6–7.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0472OpenClaw: Mehrere SchwachstellenDeutsch2026-02-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
- GHSA-4rqq-w8v4-7p47OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard2026-03-04ghsa · osvUS
### Summary `isPrivateIpv4()` in bundled SSRF guard code missed several IPv4 special-use/non-global ranges, so `web_fetch` could allow targets that should be blocked by SSRF policy. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published affected version: `2026.2.21-2` (published 2026-02-21) - Structured vulnerable range: `<= 2026.2.21-2` - Planned patched version (pre-set): `>= 2026.2.22` ### Impact Low severity. Exploitation requires network reachability to the relevant special-use ranges and a request path that reaches `web_fetch` URL fetching. ### Technical Details Affected releases used narrow IPv4 private-range checks that omitted multiple RFC special-use/non-global ranges. This allowed requests such as `http://198.18.0.1/...` through SSRF validation in affected releases. Follow-up hardening consolidates local-host/tailnet range checks so gateway/browser/tailnet paths share one canonical IP classification flow. ### Fix Commit(s) - `71bd15bb4294d3d1b54386064d69cd0f5f731bd8` - `44dfbd23df453e51b71ef79a148c28c53e89168c` - `333fbb86347998526dd514290adfd5f727caa6d9` - `f14ebd743cfc73f667fae80af70043d0ab1f88bd` OpenClaw thanks @princeeismond-dot for reporting.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (19)
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclaw/commit/333fbb86347998526dd514290adfd5f727caa6d9cnnvd
- https://github.com/openclaw/openclaw/commit/44dfbd23df453e51b71ef79a148c28c53e89168ccnnvd
- https://github.com/openclaw/openclaw/commit/71bd15bb4294d3d1b54386064d69cd0f5f731bd8cnnvd
- https://github.com/openclaw/openclaw/commit/f14ebd743cfc73f667fae80af70043d0ab1f88bdcnnvd
- https://github.com/openclaw/openclaw/releasesPatchcnnvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-4rqq-w8v4-7p47cnnvd
- https://www.vulncheck.com/advisories/openclaw-incomplete-ipv4-special-use-range-blocking-in-ssrf-guardcnnvd
- https://github.com/openclaw/openclaw/commit/333fbb86347998526dd514290adfd5f727caa6d9enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan