CVE-2026-22181

HIGH

OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch

Title source: cna
STIX 2.1

Description

OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy variables are configured. When HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are present, attacker-influenced URLs can be routed through proxy behavior instead of pinned-destination routing, enabling access to internal targets reachable from the proxy environment.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
GitHub Security Advisory (GHSA-8mvx-p2r9-r375)
https://github.com/openclaw/openclaw/security/advisories/GHSA-8mvx-p2r9-r375
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch
https://www.vulncheck.com/advisories/openclaw-dns-pinning-bypass-via-environment-proxy-configuration-in-web-fetch

Scores

CVSS v3 7.6
EPSS 0.0006
EPSS Percentile 17.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (4)
npm/openclaw 0 - 2026.3.2npm
OpenClaw/OpenClaw < 2026.3.2
openclaw/openclaw < 2026.3.2
OpenClaw/OpenClaw 2026.3.2
Published Mar 18, 2026
Tracked Since Mar 18, 2026