PT-2026-26229 · Openclaw · Openclaw

Tdjackey · Publicado 2026-03-02 · Atualizado 2026-03-20 · CVE-2026-31989

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description The software contains a server-side request forgery issue in the web search citation redirect resolution. This is due to the use of a private-network-allowing SSRF policy. An attacker who can control citation redirect targets may be able to trigger requests to internal network destinations from the OpenClaw host. The web search function is involved in this issue.

Recommendations Update to version 2026.3.1 or later. Citation redirect resolution now uses a strict SSRF policy, blocking localhost, private, and internal redirect targets.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2026-05250

CVE-2026-31989

GHSA-44C9-4RG5-QJGQ

GHSA-G99V-8HWM-G76G

Produtos afetados

Openclaw

Referências · 13

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-g99v-8hwm-g76g · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31989 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2034879607300923783 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05250 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-44c9-4rg5-qjgq · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/2034508373320671678 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31989 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034520395139662028 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-g99v-8hwm-g76g · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-via-web-search-citation-redirect · Nota
• https://twitter.com/VulmonFeeds/status/2034511355860877340 · Publicação no Twitter
• https://twitter.com/vuln_tracker/status/2034696935341224267 · Publicação no Twitter