PT-2026-26229 · Openclaw · Openclaw

Tdjackey · Published 2026-03-02 · Updated 2026-03-20 · CVE-2026-31989

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description The software contains a server-side request forgery issue in the web search citation redirect resolution. This is due to the use of a private-network-allowing SSRF policy. An attacker who can control citation redirect targets may be able to trigger requests to internal network destinations from the OpenClaw host. The web search function is involved in this issue.

Recommendations Update to version 2026.3.1 or later. Citation redirect resolution now uses a strict SSRF policy, blocking localhost, private, and internal redirect targets.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-05250

CVE-2026-31989

GHSA-44C9-4RG5-QJGQ

GHSA-G99V-8HWM-G76G

Affected Products

Openclaw

References · 13

• https://github.com/openclaw/openclaw/security/advisories/GHSA-g99v-8hwm-g76g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31989 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05250 · Security Note
• https://osv.dev/vulnerability/GHSA-44c9-4rg5-qjgq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31989 · Security Note
• https://osv.dev/vulnerability/GHSA-g99v-8hwm-g76g · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEarity/status/2034879607300923783 · Twitter Post
• https://twitter.com/RedPacketSec/status/2034508373320671678 · Twitter Post
• https://twitter.com/CVEnew/status/2034520395139662028 · Twitter Post
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-via-web-search-citation-redirect · Note
• https://twitter.com/VulmonFeeds/status/2034511355860877340 · Twitter Post
• https://twitter.com/vuln_tracker/status/2034696935341224267 · Twitter Post