Server-Side Request Forgery (SSRF) in OpenClaw - CVE-2026-100555
Published: November 3, 2026
Vulnerability identifier: #VU158805
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-100555
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to make a NAS fetch private or policy-denied resources and disclose their contents to an addressed Synology Chat conversation.
The vulnerability exists due to loss of DNS pinning in OpenClaw's Synology Chat attachment delivery when forwarding a remotely influenced file URL to a NAS. A remote user can use DNS rebinding to make the original hostname resolve to a different destination on the NAS than the address validated by the Gateway, causing the NAS to fetch a private or policy-denied resource and return its contents to the conversation.
Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination.
Affected software
OpenClaw
How to mitigate CVE-2026-100555
Install security update from vendor's website.
OpenClaw - update to 2026.8.1