Executive brief
OpenClaw is a platform that allows authenticated operators to configure hostname policies to block requests to certain destinations. A vulnerability in hostname validation allows attackers to bypass these blocklist rules by appending a trailing dot to hostnames, reaching destinations that the operator intended to block. This could enable unauthorized access to internal or blocked services depending on the operator's configuration.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) that manifests as a server-side request forgery (SSRF, CWE-918) issue in OpenClaw's hostname checking logic. When processing model or workspace-derived URLs, the application treats hostnames with trailing dots inconsistently compared to those without, allowing blocklist comparisons to be bypassed. An authenticated operator with access to the affected feature can craft requests with trailing-dot notation to reach destinations blocked by hostname policies. The issue affects versions up to 2026.5.22, with patches available in version 2026.5.26 and later.
Affected products
- OpenClaw OpenClaw before 2026.5.26
Timeline
- 2026-05-28: disclosed
- 2026-05-26: patched: Version 2026.5.26 contains the fix
- 2026-06-16: advisory