GHSA-rhfg-j8jq-7v2hHigh

OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)

Published
March 29, 2026
Last Modified
April 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-35629 →

📋 Description

Summary

SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Several channel extensions still used raw fetch() against configured base URLs without the SSRF guard that was added for CVE-2026-28476. Commit f92c92515bd439a71bd03eb1bc969c1964f17acf routes those outbound requests through fetchWithSsrFGuard so configured endpoints cannot be rebound to blocked internal destinations.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit f92c92515bd439a71bd03eb1bc969c1964f17acf.

Fix Commit(s)

  • f92c92515bd439a71bd03eb1bc969c1964f17acf

🎯 Affected products1

  • npm/openclaw:< 2026.3.28

🔗 References (6)