Which versions of Openclaw are affected by CVE-2026-28476?

OpenClaw versions before 2026.2.14 contain a server-side request forgery vulnerability in the Tlon Urbit authentication extension that could allow attackers to abuse your infrastructure to access…. A patch is available.

How to fix or mitigate CVE-2026-28476?

Within 24 hours: Identify all OpenClaw deployments and determine which have the Tlon Urbit extension enabled. Within 7 days: Implement network segmentation to restrict OpenClaw's outbound access and deploy WAF rules to block suspicious base URL parameters; disable the Urbit extension if not business-critical. Within 30 days: Monitor vendor communications for patch availability (CVE-2026-28476) and prepare immediate deployment procedures upon release; conduct internal audit of any suspicious outbound connections from OpenClaw instances.

Openclaw CVE-2026-28476

Q: What is the CVSS score of CVE-2026-28476?

CVE-2026-28476 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-05 disclosure@vulncheck.com

GHSA-pg2v-8xwh-qhcc

SSRF Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 21, 2026 - 15:07 NVD

HIGH MEDIUM

CVSS changed

Apr 21, 2026 - 15:07 NVD

8.3 (HIGH) 6.3 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 8.3

DescriptionCVE.org

OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence the configured Urbit URL can induce the gateway to make HTTP requests to arbitrary hosts including internal addresses.

AnalysisAI

OpenClaw versions before 2026.2.14 fail to validate base URLs in the Tlon Urbit extension, allowing attackers to trigger server-side request forgery attacks that direct the gateway to arbitrary hosts, including internal systems. This network-accessible vulnerability requires no authentication and can result in information disclosure and service disruption. No patch is currently available.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects OpenClaw. OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence the configured Urbit URL can induce the gateway to make HTTP requests to arbitrary hosts including internal addresses.