CVE-2026-53859
Description
OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model or workspace-derived URLs. Attackers can exploit inconsistent hostname checks to reach destinations that operators intended to block through hostname policies.
Summary dbcve.org
OpenClaw before 2026.5.26 fails to properly normalize hostnames in blocklist comparisons, allowing attackers to bypass intended blocks by appending a trailing dot to hostnames in model or workspace-derived URLs (e.g., 'malicious.com.' vs 'malicious.com'). The validation logic inconsistently handles the trailing dot, permitting access to destinations operators meant to block.
Mitigation
Upgrade to OpenClaw version 2026.5.26 or later which implements consistent hostname normalization in blocklist comparisons. If immediate upgrade is not possible, implement URL preprocessing to strip trailing dots before blocklist evaluation.