6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pg2v-8xwh-qhcc

GHSA-pg2v-8xwh-qhcc: OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication

Summary

The optional Tlon (Urbit) extension previously accepted a user-provided base URL for authentication and used it to construct an outbound HTTP request, enabling server-side request forgery (SSRF) in affected deployments.

Impact

This only affects deployments that have installed and configured the Tlon (Urbit) extension, and where an attacker can influence the configured Urbit URL. Under those conditions, the gateway could be induced to make HTTP requests to attacker-chosen hosts (including internal addresses).

Deployments that do not use the Tlon extension, or where untrusted users cannot change the Urbit URL, are not impacted.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.13

Fixed Versions

2026.2.14 (planned next release)

Fix Commit(s)

bfa7d21e997baa8e3437657d59b1e296815cc1b1

Details

Urbit authentication now validates and normalizes the base URL and uses an SSRF guard that blocks private/internal hosts by default (opt-in: channels.tlon.allowPrivateNetwork).

Release Process Note

This advisory is pre-populated with the planned patched version (2026.2.14). After openclaw@2026.2.14 is published to npm, publish this advisory without further edits.

Thanks @p80n-sec for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pg2v-8xwh-qhcc

GHSA-pg2v-8xwh-qhcc:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the Tlon (Urbit) extension of OpenClaw, caused by the direct use of a user-provided URL in outbound HTTP requests without proper validation. An attacker with control over the Urbit URL configuration could compel the server to send requests to arbitrary hosts, including internal network services.

The analysis of the fixing commit, bfa7d21e997baa8e3437657d59b1e296815cc1b1, pinpointed the vulnerable functions. The core issue resided in multiple functions that utilized the native fetch API with URLs constructed from un-sanitized user input.

The most direct vulnerability was in the authenticate function (extensions/tlon/src/urbit/auth.ts), which constructed a login URL directly from the user-supplied url parameter. Similarly, the Urbit.prototype.connect method (in the now-removed extensions/tlon/src/urbit/http-api.ts) and several methods within the UrbitSSEClient class (connect, subscribe, poke, scry) were also making insecure fetch calls to URLs derived from the user's input.

The patch addresses this by:

Introducing fetchWithSsrFGuard, a new function that validates URLs against a list of private and blocked hostnames before making a request.
Replacing all instances of the native fetch in the affected functions with the new guarded fetch implementation.
Implementing a new UrbitChannelClient that uses the secure fetch logic, replacing the old insecure Urbit.prototype.connect.
Adding a new configuration option, allowPrivateNetwork, to provide an explicit opt-in for administrators who need to connect to Urbit ships on private networks, acknowledging the associated risk.

Vulnerable functions

authenticate

extensions/tlon/src/urbit/auth.ts

The `authenticate` function directly used the user-provided `url` parameter to construct a request URL for the `fetch` API without any validation. This allowed an attacker to specify an arbitrary URL, leading to a Server-Side Request Forgery (SSRF) vulnerability.

Urbit.connect

extensions/tlon/src/urbit/http-api.ts

This file, which was removed in the patch, contained a method `Urbit.prototype.connect` that was used for authentication. It made a `fetch` request to a URL constructed from `this.url`, which was user-controllable. The entire file and its insecure logic were replaced by a new secure client.

UrbitSSEClient.connect

extensions/tlon/src/urbit/sse-client.ts

The `connect` method within the `UrbitSSEClient` class made direct `fetch` calls to `this.channelUrl`, which is derived from the user-provided base URL. This allowed for SSRF when establishing a connection. The patch replaced this with a call to the secure `urbitFetch` function.

UrbitSSEClient.subscribe

extensions/tlon/src/urbit/sse-client.ts

The `subscribe` method in `UrbitSSEClient` was vulnerable to SSRF because it used the native `fetch` API to send a request to `this.channelUrl`, a URL constructed from user-controlled input, without proper validation.

UrbitSSEClient.scry

extensions/tlon/src/urbit/sse-client.ts

The `scry` method in `UrbitSSEClient` constructed a `scryUrl` from the user-provided base URL and made a request using `fetch`. This exposed an SSRF vulnerability, as no validation was performed on the URL.

UrbitSSEClient.poke

extensions/tlon/src/urbit/sse-client.ts

The `poke` method in `UrbitSSEClient` was vulnerable to SSRF as it made a `fetch` request to `this.channelUrl`, which is derived from a user-provided URL, without any security checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-pg2v-8xwh-qhcc: OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication

Summary

Impact

Affected Packages / Versions

Fixed Versions

Fix Commit(s)

Details

Release Process Note

GHSA-pg2v-8xwh-qhcc:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

6.5

6.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

GHSA-pg2v-8xwh-qhcc: OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication

Summary

Impact

Affected Packages / Versions

Fixed Versions

Fix Commit(s)

Details

Release Process Note

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI