EUVD-2026-87983

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...

CVE-2026-101058 python-utcp before 1.1.12 SSRF via Remote HTTP Manual

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...

CVE-2026-100863 Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Heym versions 0.0.90 and earlier contain two server-side request forgery SSRF egress gaps, both remediated in app/services/ssrfguard.py in 0.0.91. First, the LLM image-edit input loader loadimagebytes fetched caller-controlled HTTP/HTTPS URLs with a bare httpx.get, applying only a scheme check an...

CVE-2026-100848 AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

AzuraCast Composer package azuracast/azuracast before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri and performs no host or IP address restriction. A user holding only the station-scope...

CVE-2026-101058: Server-Side Request Forgery (SSRF)

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...

CVE-2026-100860: Not Failing Securely

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node backend/app/services/nodeexecution/nodes/redisnode.py. When getaccessiblecredential returns None — because the credential ID does not exist or the caller is not authorized to use it —...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642

SiYuan versions v2.1.0 through v3.8.4 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the CheckAuth lock-screen pass-through branch . The root cause is the failure to validate Origin headers , which allows attackers to grant administrator access to loopback requests. By crafting mal...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100573

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100576

Versions of OpenClaw prior to 2026.8.1 are vulnerable to a server-side request forgery (SSRF) vulnerability within browser wait predicates. The root cause is that the wait --fn function can be used against an existing browser session to request loopback or private destinations . This allows attac...

CVE-2026-100576

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-100576 OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-100574

The OpenClaw npm package (openclaw ) versions prior to 2026.8.1 is vulnerable to a server-side request forgery (SSRF) due to a flaw in its trusted-host DNS checks . Specifically, when using trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (such as 0.0.0.0 or ::...

EUVD-2026-87477

OpenClaw npm package 'openclaw' before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address 0.0.0.0 or :: bypasses the SSRF destination validation...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573

OpenClaw versions prior to 2026.8.1 are vulnerable to a sandbox policy bypass within the MCP loopback component . This flaw enables sandboxed coding-agent sessions to circumvent the sandbox.tools.deny policy, allowing them to list and invoke tools that were explicitly restricted by the operator. ...

CVE-2026-100573

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...