AI agent vulnerability · OpenClaw

GHSA-h97f-6pqj-q452: OpenClaw has a IPv6 multicast SSRF classifier bypass

mediumCVSS 4.0 6.3

Summary OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (ff00::/8) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks. Impact A bypass in address classification existed for IPv6 multicast literals. OpenClaw's network fetch/navigation paths are constrained to HTTP/HTTPS and this was triaged as low-severity defense-in-depth hardening.

Published Mar 3, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.2.24
Fixed in: 2026.2.25
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (ff00::/8) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks.

Impact

A bypass in address classification existed for IPv6 multicast literals. OpenClaw's network fetch/navigation paths are constrained to HTTP/HTTPS and this was triaged as low-severity defense-in-depth hardening.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.24
Patched versions: >= 2026.2.25

Technical Details

The IPv6 private/internal range set omitted multicast, so addresses like ff02::1 and ff05::1:3 were not classified as blocked by the shared SSRF classifier.

Fix Commit(s)

baf656bc6fd7f83b6033e6dbc2548ec75028641f

Release Process Note

patched_versions is pre-set to the planned next npm release (2026.2.25). Once that release is published on npm, the advisory is published.

OpenClaw thanks @zpbrent for reporting.

Credited to zpbrent.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries