7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-56f2-hvwg-5743

GHSA-56f2-hvwg-5743: OpenClaw affected by SSRF in Image Tool Remote Fetch

Summary

A server-side request forgery (SSRF) vulnerability in the Image tool allowed attackers to force OpenClaw to make HTTP requests to arbitrary internal or restricted network targets.

Affected Versions

npm: openclaw <= 2026.2.1

Patched Versions

npm: openclaw 2026.2.2 and later

Fix Commits

81c68f582d4a9a20d9cca9f367d2da9edc5a65ae (guard remote media fetches with SSRF checks)
9bd64c8a1f91dda602afc1d5246a2ff2be164647 (expand SSRF guard coverage)

Details

The Image tool accepts file paths, file:// URLs, data: URLs, and http(s) URLs. In vulnerable versions, http(s) URLs were fetched without SSRF protections, enabling requests to localhost, RFC1918, link-local, and cloud metadata targets.

This was fixed by routing remote media fetching through the SSRF guard (private/internal IP + hostname blocking, redirect hardening, DNS pinning).

Exploitability Notes

Requires attacker-controlled invocation of the Image tool (direct tool access, or a gateway/channel surface that forwards untrusted image arguments into tool calls).
The image tool expects the fetched content to be an image. Many high-value SSRF targets return text/JSON (for example cloud metadata endpoints), which will typically fail media-type validation. In practice, the most direct confidentiality impact comes from internal endpoints that actually return images (screenshots/renderers, camera snapshots, chart exports, etc.).
Remote fetches are GET-only with no custom headers. Some metadata services require special headers or session tokens (for example GCP Metadata-Flavor, AWS IMDSv2 token), which can further reduce the likelihood of direct credential theft in some environments.
Despite the above constraints, SSRF remains a powerful primitive: it can enable internal network probing and access to unauthenticated/internal HTTP endpoints, and can chain with other weaknesses if present.

Thanks @p80n-sec for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-56f2-hvwg-5743

GHSA-56f2-hvwg-5743:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.2	2026.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) weakness present in multiple functions across the OpenClaw codebase. The root cause was the direct use of the fetch API to make HTTP requests to user-provided URLs without proper validation. Attackers could supply URLs pointing to internal network resources (e.g., http://localhost, RFC1918 addresses), forcing the server to make requests to those endpoints.

The initial fix, commit 81c68f582d4a9a20d9cca9f367d2da9edc5a65ae, addressed the vulnerability in the primary media fetching and web fetching tools (fetchRemoteMedia, runWebFetch, fetchWithGuard). It introduced a centralized fetchWithSsrFGuard function that performs DNS pinning and blocks requests to private/internal IP addresses.

The second fix, commit 9bd64c8a1f91dda602afc1d5246a2ff2be164647, expanded this protection to other areas that were missed initially. This included the skill installation downloader (downloadFile) and several media transcription/description providers that used a shared fetchWithTimeout helper function. The patch replaced the vulnerable direct fetch calls with the new guarded implementation, effectively mitigating the SSRF risk across the application.

Vulnerable functions

runWebFetch

src/agents/tools/web-fetch.ts

The function `runWebFetch` used an internal function `fetchWithRedirects` which directly performed `fetch` operations without validating if the URL resolved to a private or blocked IP address. This allowed an attacker to force the server to make requests to internal network resources.

fetchRemoteMedia

src/media/fetch.ts

Prior to the patch, `fetchRemoteMedia` would use the global `fetch` API to retrieve content from a given URL. It did not have any SSRF protections, allowing it to fetch from internal or restricted IP addresses if a malicious URL was provided.

fetchWithGuard

src/media/input-files.ts

The `fetchWithGuard` function implemented its own logic for fetching URLs, including handling redirects. This implementation called `fetch` directly without checking for SSRF, making it vulnerable to requests targeting internal network endpoints.

loadWebMedia

src/web/media.ts

This function is an exported wrapper around `loadWebMediaInternal`, which in turn called the vulnerable `fetchRemoteMedia` function without any SSRF policy. It served as an entry point for the SSRF vulnerability when processing remote media URLs.

loadWebMediaRaw

src/web/media.ts

Similar to `loadWebMedia`, this function is another exported wrapper around `loadWebMediaInternal`. It was vulnerable because it ultimately relied on the unguarded `fetchRemoteMedia` function to retrieve remote content.

downloadFile

src/agents/skills-install.ts

The `downloadFile` function, used for installing agent skills, directly used `fetch` to download content from a URL. This lacked SSRF protection, allowing an attacker to provide a URL for a skill that pointed to an internal service, causing the server to fetch it.

fetchWithTimeout

src/media-understanding/providers/shared.ts

This shared helper function was used by multiple media understanding providers (Deepgram, Google, OpenAI). It wrapped the `fetch` call to add a timeout but performed no SSRF validation, making any provider that used it vulnerable if the base URL could be controlled by an attacker.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.6

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-56f2-hvwg-5743: OpenClaw affected by SSRF in Image Tool Remote Fetch

Summary

Affected Versions

Patched Versions

Fix Commits

Details

Exploitability Notes

GHSA-56f2-hvwg-5743:

7.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

7.6

7.6

GHSA-56f2-hvwg-5743: OpenClaw affected by SSRF in Image Tool Remote Fetch

Summary

Affected Versions

Patched Versions

Fix Commits

Details

Exploitability Notes

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI