Openclaw cli: OpenClaw Gateway tool allowed unrestricted gatewayUrl override (CVE-2026-26322)

The OpenClaw Gateway tool accepted a tool-supplied gatewayUrl without sufficient validation, allowing the OpenClaw host to initiate outbound WebSocket connections to arbitrary endpoints, including localhost, private network addresses, or cloud metadata IPs. This could be exploited by users able to invoke tools with gatewayUrl overrides, typically authenticated operators or trusted automation. The vulnerability is not exploitable by arbitrary internet users unless the deployment exposes these tool calls to untrusted users. The impact includes outbound connection attempts, network reachability probing, and possible further interaction if the target supports WebSocket. The issue is fixed by restricting gatewayUrl overrides to loopback on the configured gateway port or the configured gateway.remote.url, rejecting disallowed protocols, credentials, query/hash, and non-root paths. The fix is planned for release in version 2026.2.14.

The vulnerability allows an attacker with the ability to invoke tools accepting gatewayUrl overrides to cause the OpenClaw host to make outbound WebSocket connection attempts to arbitrary targets. This can result in network reachability probing and potential interaction with reachable WebSocket endpoints. The impact includes confidentiality loss (C), limited integrity loss (I), and availability loss (A) as per the CVSS vector. However, exploitation requires authenticated or trusted access to the tool invocation mechanism, limiting exposure.

A patch is available and planned for release in openclaw version 2026.2.14. The fix restricts gatewayUrl overrides to loopback addresses on the configured gateway port or the configured gateway.remote.url and rejects disallowed protocols, credentials, query/hash, and non-root paths. Users should upgrade to version 2026.2.14 or later once released to remediate this vulnerability.