ClawHub Profile Image SSRF via Unchecked DNS Resolution Fix Summary

Vulnerability Key Information Summary Vulnerability Overview Title: Potential SSRF (Server-Side Request Forgery) in profile image fetching due to unchecked DNS resolution Severity: Moderate CVE ID: No known CVE Status: Resolved — Fixed and deployed in on 2026-09-11 Impact Scope Software: Affected Version: Fixed Version: Impact Description: - Public profile previews accept image URLs and check whether the textual hostname matches private address patterns, but do not validate and pin the resolved network target. - A seemingly public name may resolve to an internal address, or DNS resolution may change between validation and connection (DNS rebinding). - This issue affects the ClawHub application backend; the npm CLI and OpenClaw runtime are independent products and are not affected by this specific issue. Fix Details Fixing PR: #3631 Fixing Commit: Deployment Time: 2026-09-11 Verification Results: - The combined set of 5 fix checks passed 6,663 tests, static checks, schema/CLI endpoint TypeScript checks, build checks, and source code reviews. - Both test deployment and production deployment were successful. - The affected hosted deployment was verified post-release. Regression Verification Pre-fix: A seemingly public hostname resolving to loopback could reach a local TCP listener (1 connection). Post-fix: The same regression test recorded 0 connections, including mapped IPs and mixed public/private DNS responses. All 12 focused image tests passed. Additional Verification: - Public HTTPS GitHub avatars still pass normal TLS verification (Node 24). - passed (6,624 tests), passed. - Automated review: clean, no actionable findings. Test Notes: Regression checks used synthetic fixtures and disposable local routes. Live release verification used public routes and credential-rejection checks; internal network probing or custom data mutation was not performed. The local network harness demonstrated and prevented connections to owner-controlled loopback listeners. Internal production services were not tested. Severity Assessment Rating: Moderate, unchanged. Rationale: The local harness demonstrated network connectivity to owner-controlled private addresses via unchecked DNS responses. Access to sensitive internal services, credential disclosure, and code execution in the production environment were not demonstrated. HTTPS and existing image-host restrictions still constrain the path, but the lack of target validation remains a security boundary violation. Note: This is a qualitative maintainer assessment; no numerical CVSS score was assigned. The severity description applies to the vulnerability in affected versions, independent of the completed hosted deployment. --- > Note: POC code or exploit code blocks are not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

ClawHub Profile Image SSRF via Unchecked DNS Resolution Fix Summary

More from this source