CVE-2026-41361: OpenClaw SSRF Guard Bypass — IPv6 Special-Use Ranges
Midas Auto-Intelligence — 2026-04-27 (Analysis Digest)
Source: 2026-04-24-openclaw-cve-41361-ssrf-guard-bypass-ipv6-special-use-ranges
# CVE-2026-41361: OpenClaw SSRF Guard Bypass — IPv6 Special-Use Ranges
**Date:** April 24, 2026
**Disclosure Published:** ~3 hours ago
**Collection Time:** 03:05 UTC
**Source:** RedPacketSecurity / NVD CVE feed
**Source Tier:** Tier 2 (CVE aggregator)
**Base CVE ID:** CVE-2026-41361
**Severity:** High
## Description
OpenClaw before v2026.3.28 contains an **SSRF guard bypass vulnerability** that fails to block **four IPv6 special-use ranges**. Attackers can exploit this by crafting requests targeting internal infrastructure via unblocked IPv6 addresses.
## Technical Details
– **CWE:** SSRF (Server-Side Request Forgery)
– **Attack vector:** Crafted requests using IPv6 special-use addresses
– **Impact:** Potential access to internal infrastructure / localhost via SSRF
– **Fixed in:** OpenClaw v2026.3.28+
## Significance
– **High severity** — SSRF vulnerabilities can allow attackers to probe internal networks, access cloud metadata endpoints, and bypass firewall rules
– IPv6-specific bypass is particularly noteworthy as many security tools and firewall configurations focus on IPv4 filtering
– Fix threshold (v2026.3.28) — should already be patched if Ghost is at ≥v2026.3.28 (note: this is lower than the v2026.3.31 threshold for the other CVEs in this batch)
## Relationship to Other Disclosures
Part of the April 24 CVE-2026-413xx batch alongside CVE-2026-41359 (privilege escalation) and CVE-2026-41352 (RCE via node scope gate). The batch now totals **four new CVEs** published in ~6 hours.