Openclaw cli: OpenClaw affected by SSRF in Image Tool Remote Fetch

A SSRF vulnerability exists in the OpenClaw CLI Image tool in versions up to 2026.2.1, where http(s) URLs are fetched without SSRF protections. This allows attackers to force the tool to make arbitrary HTTP GET requests to internal or restricted network resources, including localhost, RFC1918, link-local, and cloud metadata endpoints. The vulnerability was fixed by adding SSRF guards such as private/internal IP and hostname blocking, redirect hardening, and DNS pinning in version 2026.2.2. Exploitation requires attacker-controlled invocation of the Image tool with untrusted image arguments. The tool expects image content, limiting some impact, but SSRF remains a significant risk for internal network reconnaissance and potential chaining with other vulnerabilities.

Successful exploitation can lead to unauthorized HTTP requests from the vulnerable system to internal or restricted network targets, potentially exposing sensitive internal services or data. Confidentiality impact is primarily on internal endpoints that return image data, while other endpoints returning non-image data may fail validation. SSRF can facilitate internal network probing and access to unauthenticated internal HTTP services. The vulnerability has a CVSS score of 7.6 (high severity), indicating a significant risk of confidentiality, integrity, and availability impacts.

A patch is available in OpenClaw CLI version 2026.2.2 and later that implements SSRF protections including IP and hostname blocking, redirect hardening, and DNS pinning. Users should upgrade to version 2026.2.2 or later to remediate this vulnerability. No additional mitigations are indicated by the vendor advisory.