| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed.
An attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard.
src/shared/net/ip.ts, src/infra/net/ssrf.*
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit d61f8e5672 (Net: block missing IPv6 special-use ranges).
OpenClaw thanks @nicky-cc of Tencent zhuque Lab https://github.com/Tencent/AI-Infra-Guard for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free