GHSA-8cp7-rp8r-mg77 OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Attackers can bypass SSRF protections in OpenClaw to access internal network resources via crafted ISATAP IPv6 URLs.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8cp7-rp8r-mg77?
GHSA-8cp7-rp8r-mg77 is a server-side request forgery vulnerability in openclaw, published on 4 Mar 2026. It can be exploited over the network, with no action from the victim.
Official description
Summary
OpenClaw's SSRF hostname/IP guard did not detect ISATAP embedded IPv4 addresses (...:5efe:w.x.y.z). A crafted URL containing an ISATAP IPv6 literal could embed a private IPv4 target (for example loopback) and bypass private-address filtering in URL-fetching paths.
Severity Assessment
Rated medium: the bug weakens SSRF protections in URL fetch flows, but impact depends on reaching a URL-fetching path with attacker-controlled input and is generally constrained to internal network access attempts.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
>=2026.1.20 <=2026.2.17 - Latest published at patch time:
2026.2.17 - Patched release:
2026.2.19
Security Policy Context
Per SECURITY.md, OpenClaw's web/gateway surface is intended for local use by default, public internet exposure is out-of-scope, and prompt-injection reports are out-of-scope for bounty handling. This advisory tracks a core SSRF-guard bypass in fetch protections.
Impact
This can permit SSRF-style access attempts to internal/private network targets through URL ingestion/fetch paths that rely on shared hostname/IP blocking.
Fix
- Added RFC 5214 ISATAP embedded-IPv4 detection to the shared SSRF classifier.
- Centralized hostname/IP blocking through
isBlockedHostnameOrIpand routed relevant validators to that shared path. - Added regression tests for ISATAP private vs public embedded IPv4 handling.
Fix Commit(s)
d51929ecb52fe65e90bf36795f4247feb29eb8aa
OpenClaw thanks @zpbrent for reporting.
Which versions are affected by GHSA-8cp7-rp8r-mg77?
2 open source packages ship an affected version, including openclaw.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | From 2026.1.20 | 2026.2.19 |
openclaw npm | From 2026.1.20 | 2026.2.19 |
How do I fix GHSA-8cp7-rp8r-mg77?
Upgrade openclaw to 2026.2.19 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is GHSA-8cp7-rp8r-mg77 being exploited?
There is no known exploitation of GHSA-8cp7-rp8r-mg77 in the wild and no public exploit code.