CVE-2026-6011
high
CVSS v3
8.1
CVSS v2
5.1
VIR risk
8.1
Description
OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts
Predictions
Exploit likelihood
88%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cna@vuldb.com — https://vuldb.com/submit/795224
Vendor advisory: cna@vuldb.com — https://github.com/zast-ai/vulnerability-reports/blob/main/openclaw/ssrf.md
Vendor advisory: cna@vuldb.com — https://github.com/openclaw/openclaw/releases/tag/v2026.1.29
Vendor advisory: cna@vuldb.com — https://github.com/openclaw/openclaw/commit/b623557a2ec7e271bda003eb3ac33fbb2e218505#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR44
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| npm | openclaw | <2026.1.29 | 2026.1.29 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| openclaw | openclaw | {"endExcluding":"2026.1.29"} | 2026.1.29 |
References
- https://github.com/openclaw/openclaw/
- https://github.com/openclaw/openclaw/commit/b623557a2ec7e271bda003eb3ac33fbb2e218505#diff-06572a96a58dc510037d5efa622f9bec8519bc1beab13c9f251e97e657a9d4edR44
- https://github.com/openclaw/openclaw/releases/tag/v2026.1.29
- https://github.com/zast-ai/vulnerability-reports/blob/main/openclaw/ssrf.md
- https://vuldb.com/submit/795224
- https://vuldb.com/vuln/356567
- https://vuldb.com/vuln/356567/cti
- https://nvd.nist.gov/vuln/detail/CVE-2026-6011
- https://github.com/openclaw/openclaw
CWEs
CWE-918
Verify integrity in audit chain (admin only). AS-IS.