CVE-2026-41361: Openclaw

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting URLs targeting internal or non-routable IPv6 addresses to bypass SSRF protections.

Affected products

• Openclaw Openclaw: before 2026.3.28 (fixed in 2026.3.28)

Published 2026-04-23. Last modified 2026-06-17.