222N5

**Name of the Vulnerable Software and Affected Versions** AutoGPT versions prior to 0.6.52 **Description** An authenticated user can bypass Server-Side Request Forgery (SSRF) and private-IP protections within the `SendWebRequestBlock` to access internal network services. The issue occurs because the ` is ip blocked()` function in `backend/backend/util/request.py` fails to normalize IPv4-mapped IPv6 addresses before comparing resolved IPs against blocked IPv4 ranges. Additionally, it does not block special-use ranges such as 100.64.0.0/10 (Carrier-Grade NAT, a mechanism allowing service providers to share a single public IPv4 address among multiple customers). Consequently, a hostname resolving to an IPv4-mapped IPv6 address can bypass validation and reach internal IPv4 endpoints. **Recommendations** Update to version 0.6.52.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.2.14 **Description** The gateway component fails to sanitize internal approval fields in `node.invoke` parameters, allowing authenticated clients to bypass exec approval gating for `system.run` commands. Attackers with valid gateway credentials can inject approval control fields to execute arbitrary commands on connected node hosts, potentially compromising developer workstations and CI runners. The gateway forwarded user-controlled `params` to node hosts without sanitizing internal approval fields. The node host treated `params.approved === true` and/or `params.approvalDecision` as sufficient to skip the approval workflow. The affected component is the gateway method `node.invoke` for the node command `system.run`. **Recommendations** Upgrade to OpenClaw version 2026.2.14 or later. Restrict access to the gateway. Rotate gateway credentials if you suspect token exposure. Disable remote command execution on nodes by blocking `system.run` at the gateway and/or by configuring node exec security to `deny`.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.1.5 through 2026.2.13 **Description** The OpenClaw Gateway does not adequately limit configured hook module paths before passing them to the `import()` function, potentially allowing for code execution. An attacker with the ability to modify gateway configuration can load and execute unintended local modules within the Node.js process. This requires access to modify gateway configuration, which is considered a high privilege. The vulnerable component involves the `import()` function and the configuration parameters `hooks.mappings[].transform.module` and `hooks.internal.handlers[].module`. **Recommendations** Upgrade to version 2026.2.14 or newer. Avoid exposing gateway configuration endpoints to untrusted networks. Review configuration for unsafe values in `hooks.mappings[].transform.module` and `hooks.internal.handlers[].module`.

**Name of the Vulnerable Software and Affected Versions** AutoGPT versions prior to 0.6.48 **Description** AutoGPT is a platform for creating and managing AI agents to automate workflows. An authenticated user could achieve Remote Code Execution (RCE) on the backend server. This occurred because the `BlockInstallationBlock`, a tool for writing and importing Python code, was marked as disabled but graph validation did not enforce this setting. By including the block as a node within a graph, users bypassed the restriction. The vulnerable component is the `BlockInstallationBlock`. **Recommendations** Update to version 0.6.48 or later.