PT-2026-21339 · Openclaw · Openclaw

Adam55A-Code · Published 2026-02-20 · Updated 2026-02-21 · CVE-2026-27488

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.17 and below

Description OpenClaw is a personal AI assistant. The cron webhook delivery in src/gateway/server-cron.ts uses the fetch() function directly, allowing webhook targets to access private, metadata, and internal endpoints without Server-Side Request Forgery (SSRF) policy checks. This could potentially allow unauthorized access to internal resources. Server-Side Request Forgery (SSRF) is a web security flaw that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing.

Recommendations Versions prior to 2026.2.19 are affected. Update OpenClaw to version 2026.2.19 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27488

GHSA-W45G-5746-X9FP

Affected Products

Openclaw

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27488.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-w45g-5746-x9fp · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/99db4d13e5c139883ef0def9ff963e9273179655 · Patch
• https://osv.dev/vulnerability/GHSA-w45g-5746-x9fp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27488 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27488 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.19 · Note
• https://twitter.com/_cvereports/status/2025166272674066522 · Twitter Post
• https://t.me/CVEtracker/45376 · Telegram Post
• https://twitter.com/CVEnew/status/2025154160140693725 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1raarn5/resumen_diario_de_vulnerabilidades_20022026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2025160137233539190 · Twitter Post
• https://twitter.com/tau_rho_ai/status/2025181819302281569 · Twitter Post