Openclaw
CVE-2026-27488
HIGH
GHSA-w45g-5746-x9fp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister malicious cron webhook
-
ExploitSpecify internal endpoint URL as target
-
ExecutionOpenClaw fetches internal metadata
-
ImpactAttacker receives sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | OpenClaw versions 2026.2.17 and below with cron webhook functionality enabled; attacker capability to register or modify webhook targets pointing to internal endpoints (e.g., cloud metadata services, private APIs) without SSRF validation. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OpenClaw versions 2026.2.17 and earlier allow unauthenticated remote attackers to access internal and metadata endpoints through unprotected cron webhook delivery mechanisms that lack SSRF validation. An attacker can exploit this to reach private services and endpoints that should be restricted, potentially leading to information disclosure or lateral movement within the infrastructure. A patch is available in version 2026.2.19.
Earlier versions of this analysis (1)
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. [CVSS 7.3 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 2026.2.19.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Openclaw. OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
Executive ViewAI
OpenClaw AI assistant installations in versions 2026.2.17 and below contain a server-side request forgery (SSRF) vulnerability in webhook delivery that allows attackers to access internal metadata endpoints and private systems. Organizations using OpenClaw for enterprise workflows face potential exposure of sensitive configuration data, credentials, and internal service information if exploited.
Apply vendor patch. If immediate patching is not possible: disable OpenClaw webhook functionality; restrict outbound network access from OpenClaw servers to external IPs only (block internal/private IP ranges); implement WAF rules to block requests containing metadata endpoint patterns; segment OpenClaw from internal service networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Affected Products (CPE)GitHub Advisory
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB