CVE-2026-27488: Openclaw Openclaw SSRF Vulnerability

CVE-2026-27488 Overview

CVE-2026-27488 is a Server-Side Request Forgery (SSRF) vulnerability affecting OpenClaw, a personal AI assistant application. In versions 2026.2.17 and below, the Cron webhook delivery mechanism in src/gateway/server-cron.ts uses fetch() directly without implementing SSRF policy checks. This allows webhook targets to reach private, metadata, and internal endpoints that should be protected.

Critical Impact

Attackers can leverage the SSRF vulnerability to access internal services, cloud metadata endpoints, and private network resources by crafting malicious webhook URLs that bypass security controls.

Affected Products

• OpenClaw versions 2026.2.17 and below
• OpenClaw Node.js deployments with Cron webhook functionality enabled
• All installations utilizing the src/gateway/server-cron.ts component

Discovery Timeline

• 2026-02-21 - CVE-2026-27488 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-27488

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery). The flaw exists in OpenClaw's gateway component where Cron-scheduled webhook deliveries are processed. When the application executes scheduled tasks that require webhook callbacks, the fetch() function is called directly on user-controllable webhook URLs without validating whether the target destination is an internal, private, or metadata endpoint.

The absence of SSRF protection allows an attacker to specify webhook URLs pointing to internal network addresses (e.g., 127.0.0.1, 169.254.169.254 for cloud metadata services, or internal hostnames). The server will then make requests to these destinations on behalf of the attacker, potentially exposing sensitive information or enabling further attacks against internal services.

Root Cause

The root cause of this vulnerability lies in the direct use of fetch() for webhook delivery without implementing an SSRF guard. The original implementation in src/gateway/server-cron.ts lacked URL validation and filtering mechanisms that would prevent requests to private IP ranges, localhost, cloud metadata endpoints, and other sensitive internal destinations.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with the ability to configure webhook URLs within OpenClaw can set a malicious destination pointing to internal resources. When the Cron service triggers webhook delivery, the server executes the request, allowing the attacker to:

1. Access cloud provider metadata services to steal credentials
2. Probe internal network services for reconnaissance
3. Interact with internal APIs not intended for external access
4. Potentially pivot to other systems within the network

// Security patch in src/gateway/server-cron.ts
// Source: https://github.com/openclaw/openclaw/commit/99db4d13e5c139883ef0def9ff963e9273179655

 import { CronService } from "../cron/service.js";
 import { resolveCronStorePath } from "../cron/store.js";
 import { normalizeHttpWebhookUrl } from "../cron/webhook-url.js";
+import { formatErrorMessage } from "../infra/errors.js";
 import { runHeartbeatOnce } from "../infra/heartbeat-runner.js";
 import { requestHeartbeatNow } from "../infra/heartbeat-wake.js";
+import { fetchWithSsrFGuard } from "../infra/net/fetch-guard.js";
+import { SsrFBlockedError } from "../infra/net/ssrf.js";
 import { enqueueSystemEvent } from "../infra/system-events.js";
 import { getChildLogger } from "../logging.js";
 import { normalizeAgentId, toAgentStoreSessionKey } from "../routing/session-key.js";

The patch replaces direct fetch() calls with fetchWithSsrFGuard(), which validates URLs against an SSRF policy before making requests. The new SsrFBlockedError is introduced to handle blocked request attempts appropriately.

Detection Methods for CVE-2026-27488

Indicators of Compromise

• Webhook configurations containing internal IP addresses (127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Webhook URLs targeting cloud metadata endpoints (169.254.169.254, metadata.google.internal)
• Unusual outbound requests from the OpenClaw server to internal network addresses
• Error logs indicating failed connections to internal services from the gateway component

Detection Strategies

• Monitor webhook URL configurations for internal or reserved IP addresses
• Implement network-level detection for requests from OpenClaw servers to metadata endpoints
• Review Cron job logs for suspicious webhook destinations
• Deploy web application firewall rules to detect SSRF patterns in webhook URLs

Monitoring Recommendations

• Enable verbose logging on the src/gateway/server-cron.ts component to capture webhook destinations
• Configure network segmentation alerts for unexpected traffic from application servers to internal networks
• Implement DNS query logging to detect resolution of internal hostnames by external-facing services
• Set up alerts for SsrFBlockedError exceptions after upgrading to the patched version

How to Mitigate CVE-2026-27488

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.19 or later immediately
• Audit existing webhook configurations for malicious or internal URLs
• Implement network-level controls to restrict outbound connections from OpenClaw servers
• Review access logs for evidence of exploitation attempts

Patch Information

The vulnerability has been fixed in OpenClaw version 2026.2.19. The fix introduces fetchWithSsrFGuard() as a replacement for direct fetch() calls, implementing proper URL validation and blocking requests to private, internal, and metadata endpoints. Detailed information is available in the GitHub Security Advisory GHSA-w45g-5746-x9fp and the security patch commit.

Workarounds

• Deploy network-level egress filtering to block requests to internal IP ranges and cloud metadata endpoints
• Configure firewall rules to prevent the OpenClaw application from accessing sensitive internal services
• Disable Cron webhook functionality if not required until the patch can be applied
• Implement a reverse proxy with SSRF filtering capabilities in front of the OpenClaw gateway

# Configuration example - Network-level SSRF mitigation using iptables
# Block outbound connections to private IP ranges from OpenClaw server

# Block localhost
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner openclaw -j DROP

# Block private networks
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner openclaw -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner openclaw -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner openclaw -j DROP

# Block cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254/32 -m owner --uid-owner openclaw -j DROP