6.3

CVE-2026-6011

A weakness has been identified in OpenClaw up to 2026.1.26. Affected by this issue is some unknown functionality of the file src/agents/tools/web-fetch.ts of the component assertPublicHostname Handler. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2026.1.29 can resolve this issue. This patch is called b623557a2ec7e271bda003eb3ac33fbb2e218505. Upgrading the affected component is advised.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt OpenClaw
Version 2026.1.0
Status affected
Version 2026.1.1
Status affected
Version 2026.1.2
Status affected
Version 2026.1.3
Status affected
Version 2026.1.4
Status affected
Version 2026.1.5
Status affected
Version 2026.1.6
Status affected
Version 2026.1.7
Status affected
Version 2026.1.8
Status affected
Version 2026.1.9
Status affected
Version 2026.1.10
Status affected
Version 2026.1.11
Status affected
Version 2026.1.12
Status affected
Version 2026.1.13
Status affected
Version 2026.1.14
Status affected
Version 2026.1.15
Status affected
Version 2026.1.16
Status affected
Version 2026.1.17
Status affected
Version 2026.1.18
Status affected
Version 2026.1.19
Status affected
Version 2026.1.20
Status affected
Version 2026.1.21
Status affected
Version 2026.1.22
Status affected
Version 2026.1.23
Status affected
Version 2026.1.24
Status affected
Version 2026.1.25
Status affected
Version 2026.1.26
Status affected
Version 2026.1.29
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.05% 0.139
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@vuldb.com 5.6 2.2 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
cna@vuldb.com 6.3 0 0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 5.1 4.9 6.4
AV:N/AC:H/Au:N/C:P/I:P/A:P
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.