{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-41361/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-41361"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenClaw"],"_cs_severities":["medium"],"_cs_tags":["ssrf","cve-2026-41361","openclaw"],"_cs_type":"advisory","_cs_vendors":["OpenClaw"],"content_html":"\u003cp\u003eOpenClaw before version 2026.3.28 is susceptible to a Server-Side Request Forgery (SSRF) guard bypass vulnerability, identified as CVE-2026-41361. This flaw stems from the software's inability to properly block four specific IPv6 special-use ranges. By exploiting this vulnerability, attackers can craft malicious URLs that target internal or non-routable IPv6 addresses, effectively circumventing SSRF protections. This can allow attackers to probe internal services, access sensitive data, or potentially perform unauthorized actions within the internal network. Successful exploitation requires the application to process attacker-supplied URLs.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an OpenClaw instance running a version prior to 2026.3.28.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious URL containing an IPv6 address from one of the four unblocked special-use ranges (e.g., targeting a link-local address).\u003c/li\u003e\n\u003cli\u003eThe crafted URL is submitted to the OpenClaw instance, potentially through a user-supplied input field or a request parameter.\u003c/li\u003e\n\u003cli\u003eOpenClaw's SSRF guard fails to recognize the IPv6 address as internal or restricted due to the incomplete blocking.\u003c/li\u003e\n\u003cli\u003eThe OpenClaw server attempts to resolve the IPv6 address specified in the crafted URL.\u003c/li\u003e\n\u003cli\u003eThe server sends a request to the internal resource or service associated with the malicious IPv6 address.\u003c/li\u003e\n\u003cli\u003eThe server receives a response from the internal resource.\u003c/li\u003e\n\u003cli\u003eThe attacker obtains sensitive information from the internal resource or uses the vulnerable server to pivot to other internal systems.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SSRF vulnerability can lead to the exposure of sensitive internal information, such as configuration files, database credentials, or API keys. An attacker could also leverage the vulnerable server to access and interact with other internal services, potentially leading to lateral movement within the network. There is no indication of the number of victims or sectors affected at this time, but the potential impact includes unauthorized data access and compromised internal systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.3.28 or later to remediate the SSRF guard bypass vulnerability described in CVE-2026-41361.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation and access controls to limit the impact of potential SSRF vulnerabilities by restricting access to sensitive internal resources.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests containing IPv6 addresses from special-use ranges, using a rule similar to the Sigma rule provided, and investigate any suspicious activity.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect exploitation attempts. Tune it for your specific environment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-24T12:00:00Z","date_published":"2026-04-24T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-ssrf/","summary":"OpenClaw before 2026.3.28 is vulnerable to a Server-Side Request Forgery (SSRF) guard bypass due to its failure to block four IPv6 special-use ranges, allowing attackers to craft URLs targeting internal or non-routable IPv6 addresses.","title":"OpenClaw SSRF Guard Bypass via IPv6 Special Use Ranges (CVE-2026-41361)","url":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-41361","version":"https://jsonfeed.org/version/1.1"}