CVE-2026-32019 LOW

CVE-2026-32019: OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard

Vendor Openclaw
Product OpenClaw
Weakness CWE-918 · SSRF
Published March 19, 2026
Last update March 25, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L

What the vulnerability does

01Description

OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to special-use IPv4 ranges can exploit web_fetch functionality to access blocked addresses such as 198.18.0.0/15 and other non-global ranges.

Key dates

02Disclosure timeline

March 19, 2026 CVE published
March 25, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-45012 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget CVE-2024-28752 Apache CXF SSRF Vulnerability using the Aegis databinding CVE-2024-37157 Discourse vulnerable to Server-Side Request Forgery via FastImage CVE-2025-59138 WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-33990 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)