https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 14:32:45 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-22181 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary `openclaw` web tools strict URL fetch paths could lose DNS pinning when environment proxy variables are configured (`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`, including lowercase variants).</p> <p>In affected builds, strict URL checks (for example `web_fetch` and citation redirect resolution) validated one destination during SSRF guard checks, but runtime connection routing could proceed through an env-proxy dispatcher.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable version range: `&lt;= 2026.3.1` - Latest published npm version at triage time (2026-03-02): `2026.3.1` - Patched versions: `&gt;= 2026.3.2` (released)</p> <p>### Technical Details The SSRF guard performed hostname resolution and policy checks, then selected a request dispatcher.</p> <p>When env proxy settings were present, strict web-tool flows could use `EnvHttpProxyAgent` instead of the DNS-pinned dispatcher. This created a destination-binding gap between check-time resolution and connect-time routing.</p> <p>The fix keeps DNS pinning on strict/untrusted web-tool URL paths and limits env-proxy bypass behavior to trusted/operator-controlled endpoints via an explicit dangerous opt-in.</p> <p>### Impact In deployments with env proxy variables configured, attacker-influenced URLs from web tools could be routed through proxy behavior instead of strict pinned-destination routing, which could allow access to internal/private targets reachable from that proxy environment.</p> <p>### Mitigations Before upgrading, operators c…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary `openclaw` web tools strict URL fetch paths could lose DNS pinning when environment proxy variables are configured (`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`, including lowercase variants).</p> <p>In affected builds, strict URL checks (for example `web_fetch` and citation redirect resolution) validated one destination during SSRF guard checks, but runtime connection routing could proceed through an env-proxy dispatcher.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable version range: `&lt;= 2026.3.1` - Latest published npm version at triage time (2026-03-02): `2026.3.1` - Patched versions: `&gt;= 2026.3.2` (released)</p> <p>### Technical Details The SSRF guard performed hostname resolution and policy checks, then selected a request dispatcher.</p> <p>When env proxy settings were present, strict web-tool flows could use `EnvHttpProxyAgent` instead of the DNS-pinned dispatcher. This created a destination-binding gap between check-time resolution and connect-time routing.</p> <p>The fix keeps DNS pinning on strict/untrusted web-tool URL paths and limits env-proxy bypass behavior to trusted/operator-controlled endpoints via an explicit dangerous opt-in.</p> <p>### Impact In deployments with env proxy variables configured, attacker-influenced URLs from web tools could be routed through proxy behavior instead of strict pinned-destination routing, which could allow access to internal/private targets reachable from that proxy environment.</p> <p>### Mitigations Before upgrading, operators c…</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-22181 https://vulnerability.circl.lu/vuln/cve-2026-22181 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy variables are configured. When HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are present, attacker-influenced URLs can be routed through proxy behavior instead of pinned-destination routing, enabling access to internal targets reachable from the proxy environment.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy variables are configured. When HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are present, attacker-influenced URLs can be routed through proxy behavior instead of pinned-destination routing, enabling access to internal targets reachable from the proxy environment.</p> https://vulnerability.circl.lu/vuln/cve-2026-22181