N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qx8j-g322-qj6m

GHSA-qx8j-g322-qj6m: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

Impact

fetchWithSsrFGuard replays unsafe request bodies across cross-origin redirects.

A guarded fetch could resend unsafe request bodies or headers when following cross-origin redirects.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <2026.3.31
Patched versions: 2026.4.8

Fix

The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.

Verification

The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.

Credits

Thanks @BG0ECV for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qx8j-g322-qj6m

GHSA-qx8j-g322-qj6m:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.8	2026.4.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 reveals a vulnerability within the fetchWithSsrFGuard function in src/infra/net/fetch-guard.ts. The vulnerability, as described, involves the replay of unsafe request bodies across cross-origin redirects. The patch addresses this by changing the order of operations within the function. Specifically, the call to resolvePinnedHostnameWithPolicy (which performs DNS pinning) was moved. Before the patch, DNS pinning was executed unconditionally. After the patch, it is only executed if a trusted environment proxy is not configured. This indicates that the vulnerability was caused by performing DNS pinning even when a proxy was supposed to handle the connection, leading to incorrect behavior during redirects. Therefore, the fetchWithSsrFGuard function is the vulnerable function as it contained this flawed logic.

Vulnerable functions

fetchWithSsrFGuard

src/infra/net/fetch-guard.ts

The vulnerability is in the `fetchWithSsrFGuard` function. It incorrectly performed DNS pinning before checking if a trusted environment proxy was configured. This could cause sensitive information in request bodies or headers to be replayed across cross-origin redirects because the redirect handling might not have been subject to the same security constraints. The patch corrects the logic to only perform DNS pinning when a trusted proxy is not in use, thus preventing the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.