What is GHSA-3qmc-rwv9-q36h?

GHSA-3qmc-rwv9-q36h is a security advisory published by GitHub Security Advisories with Medium severity. OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers,...

Which CVE IDs does GHSA-3qmc-rwv9-q36h cover?

GHSA-3qmc-rwv9-q36h covers the following CVE IDs: CVE-2026-100577. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3qmc-rwv9-q36h?

GHSA-3qmc-rwv9-q36h has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

GHSA-3qmc-rwv9-q36hMediumCVSS 6.3

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers,...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-100577 →

📋 Description

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the OpenClaw host.

🔗 References (4)

https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf
https://nvd.nist.gov/vuln/detail/CVE-2026-100577
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-server-side-request-forgery-via-video-asset
https://github.com/advisories/GHSA-3qmc-rwv9-q36h