Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the fetchWithSsrFGuard function within src/infra/net/fetch-guard.ts. The core of the issue is improper handling of network requests when a trusted proxy is configured. The function would perform DNS pinning regardless of the proxy settings. This flaw allows an attacker to bypass the intended proxy, leading to requests being sent directly to a pinned IP. In a scenario where the gateway plugin uses auth: gateway, this could escalate a request with operator.read privileges to one with operator.write privileges if the request hits an internal endpoint that implicitly trusts the origin of the request. The patch in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 rectifies this by ensuring DNS pinning is only performed when a trusted proxy is not in use, thus preventing the proxy bypass.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openclaw | npm | < 2026.4.8 | 2026.4.8 |
