Most recent entries from all

BREW-openclaw-cli-CVE-2026-27488 — OpenClaw hardened cron webhook delivery against SSRF

2026-10-10T05:39:44.435057+00:00

Affected: Homebrew: openclaw-cli

## Affected Packages / Versions

- `openclaw` npm package versions `<= 2026.2.17`.

## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.

## Fix Commit(s) - `99db4d13e` - `35851cdaf`

Thanks @Adam55A-code for reporting.

cnvd-2026-13388

2026-10-10T05:39:44.435121+00:00

cnvd-2026-13388

EUVD-2026-270427

2026-10-10T05:39:44.435139+00:00

EUVD-2026-270427

fkie_cve-2026-27488

2026-10-10T05:39:44.435152+00:00

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.

GHSA-w45g-5746-x9fp — OpenClaw hardened cron webhook delivery against SSRF

2026-10-10T05:39:44.435175+00:00

Affected: npm: openclaw

## Affected Packages / Versions

- `openclaw` npm package versions `<= 2026.2.17`.

## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.

## Fix Commit(s) - `99db4d13e` - `35851cdaf`

Thanks @Adam55A-code for reporting.