Openclaw cli: OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) (CVE-2026-35629)
Description
An SSRF (Server-Side Request Forgery) vulnerability exists in multiple channel extensions of the openclaw-cli package due to unguarded use of configured base URLs in raw fetch() calls. This is an incomplete fix for a previous vulnerability (CVE-2026-28476). The issue affects versions up to and including 2026.3.24 and was fixed in version 2026.3.25 by routing outbound requests through a guarded fetch function to prevent rebinding to blocked internal destinations.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The openclaw-cli package versions up to 2026.3.24 contain an SSRF vulnerability in several channel extensions where raw fetch() calls are made against configured base URLs without the SSRF guard introduced in a prior fix (CVE-2026-28476). This allows potential SSRF attacks by rebinding endpoints to internal destinations. The vulnerability was fixed in version 2026.3.25 by commit f92c92515bd439a71bd03eb1bc969c1964f17acf, which routes outbound requests through fetchWithSsrFGuard to enforce SSRF protections.
Potential Impact
The vulnerability allows attackers to perform SSRF attacks by exploiting unguarded fetch requests to configured base URLs, potentially enabling access to internal network resources or services that should be blocked. This could lead to unauthorized internal network access or information disclosure depending on the environment and configuration.
Mitigation Recommendations
A patch is available and should be applied by upgrading openclaw-cli to version 2026.3.25 or later. The fix routes outbound requests through a guarded fetch function to prevent SSRF attacks. Users should verify they are running a patched version and update if necessary.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-35629
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
Threat ID: 6ac245ae12601ec6a3166b0d
Added to database: 10/04/2026, 12:25:18 UTC
Last enriched: 10/04/2026, 12:55:58 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.