GHSA-h97f-6pqj-q452 OpenClaw has a IPv6 multicast SSRF classifier bypass
An SSRF classifier bypass in OpenClaw allowed IPv6 multicast addresses to evade blocking, enabling potential internal network access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-h97f-6pqj-q452?
GHSA-h97f-6pqj-q452 is a server-side request forgery vulnerability in openclaw, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (ff00::/8) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks.
Impact
A bypass in address classification existed for IPv6 multicast literals. OpenClaw's network fetch/navigation paths are constrained to HTTP/HTTPS and this was triaged as low-severity defense-in-depth hardening.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.2.24 - Patched versions:
>= 2026.2.25
Technical Details
The IPv6 private/internal range set omitted multicast, so addresses like ff02::1 and ff05::1:3 were not classified as blocked by the shared SSRF classifier.
Fix Commit(s)
baf656bc6fd7f83b6033e6dbc2548ec75028641f
Release Process Note
patched_versions is pre-set to the planned next npm release (2026.2.25). Once that release is published on npm, the advisory is published.
OpenClaw thanks @zpbrent for reporting.
Which versions are affected by GHSA-h97f-6pqj-q452?
2 open source packages ship an affected version, including openclaw.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.2.25 |
openclaw npm | All versions | 2026.2.25 |
How do I fix GHSA-h97f-6pqj-q452?
Upgrade openclaw to 2026.2.25 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is GHSA-h97f-6pqj-q452 being exploited?
There is no known exploitation of GHSA-h97f-6pqj-q452 in the wild and no public exploit code.