npm/openclaw CVE-2026-22181: high 7.6, EPSS 0.25%
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured
Action: Upgrade openclaw to 2026.3.2 or later.
npm i openclaw@2026.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.3.2 | - |
Fixed versions
| 2026.3.2 |
Sources
- osv: GHSA-8mvx-p2r9-r375
- nvd: CVE-2026-22181
- https://github.com/openclaw/openclaw/security/advisories/GHSA-8mvx-p2r9-r375
- https://github.com/openclaw/openclaw/commit/345abf0b2e0f43b0f229e96f252ebf56f1e5549e
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-dns-pinning-bypass-via-environment-proxy-configuration-in-web-fetch
CVE-2026-22181 · published · modified · JSON