CVE-2026-100577

6.3 MEDIUMpublic exploit available

Published 2026-09-26 · Updated 2026-09-30

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the OpenClaw host.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses

CWE-918

Public exploit & PoC references

https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf

All references

https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-server-side-request-forgery-via-video-asset

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100297
MEDIUMCVE-2026-100373PoC
HIGHCVE-2026-100391PoC
HIGHCVE-2026-100555PoC
HIGHCVE-2026-100567PoC
MEDIUMCVE-2026-100574PoC
MEDIUMCVE-2026-100576PoC
MEDIUMCVE-2026-100601PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.