5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-wfp2-v9c7-fh79

GHSA-wfp2-v9c7-fh79: OpenClaw affected by SSRF via attachment/media URL hydration

Summary

Versions of the openclaw npm package prior to 2026.2.2 could be coerced into fetching arbitrary http(s) URLs during attachment/media hydration. An attacker who can influence the media URL (for example via model-controlled sendAttachment or auto-reply media URLs) could trigger SSRF to internal resources and exfiltrate the fetched bytes as an outbound attachment.

Plain-English Explanation

OpenClaw can send files by downloading them first.

On vulnerable versions (< 2026.2.2), if an attacker could get OpenClaw to treat a URL as the “file to attach”, OpenClaw would download that URL from the gateway machine and then send the downloaded bytes back out as an attachment.

That matters because the gateway can often reach internal-only endpoints that an attacker cannot (for example 127.0.0.1 services, private RFC1918 addresses, or cloud metadata endpoints). This is a data-leak risk.

This does not directly grant code execution or shell access; it is about making the gateway perform HTTP requests and returning the response bytes.

Affected Packages / Versions

Package: openclaw (npm)
Affected: < 2026.2.2
Fixed: >= 2026.2.2

Release timeline (npm):

2026.2.1 published 2026-02-02T11:45:27Z
2026.2.2 published 2026-02-04T00:56:41Z
This advisory was created 2026-02-05T10:42:26Z

Details

In affected versions, remote media fetching performed a raw fetch(url) without SSRF protections.

Starting in 2026.2.2, remote media fetching is guarded by SSRF checks (private/loopback/link-local blocking, DNS pinning, and redirect handling), so attempts to fetch 127.0.0.1, private RFC1918 space, or cloud metadata hostnames are rejected.

Proof of Concept

From any context where an attacker can influence an attachment/media URL, provide a media URL targeting an internal endpoint (example: http://127.0.0.1:9999/secret.txt).

On vulnerable versions (< 2026.2.2), the gateway fetches the URL and uses the response bytes as the attachment payload.

Fix

Fix commits:

81c68f582d4a9a20d9cca9f367d2da9edc5a65ae
9bd64c8a1f91dda602afc1d5246a2ff2be164647

Mitigation

Upgrade to openclaw >= 2026.2.2.

Thanks @simecek for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-wfp2-v9c7-fh79

GHSA-wfp2-v9c7-fh79:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.2	2026.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) present in multiple functions across the openclaw codebase. The root cause is the use of fetch or wrappers around it without proper validation of the provided URLs. An attacker who can control the URL for media, attachments, or other downloadable content could cause the application to make requests to internal network resources.

The analysis of the two fix commits (81c68f582d4a9a20d9cca9f367d2da9edc5a65ae and 9bd64c8a1f91dda602afc1d5246a2ff2be164647) reveals a pattern of replacing direct fetch calls with a new centralized and secure function, fetchWithSsrFGuard. This new function implements critical SSRF defenses such as blocking private and loopback IP addresses, DNS pinning, and handling redirects securely.

The identified vulnerable functions are the ones that were modified to use this new secure fetching mechanism. These functions are the entry points in the application code that would handle a malicious URL and initiate the vulnerable outbound request. During an exploit, these are the functions that would likely appear in a runtime profile or stack trace.

Vulnerable functions

fetchRemoteMedia

src/media/fetch.ts

The function `fetchRemoteMedia` directly uses the provided `url` with `fetcher` (which defaults to `globalThis.fetch`) without any validation. This allows an attacker to specify an internal or blocked URL, leading to Server-Side Request Forgery. The patch replaces this direct call with `fetchWithSsrFGuard` which includes SSRF protection.

runWebFetch

src/agents/tools/web-fetch.ts

The function `runWebFetch` used an internal helper `fetchWithRedirects` which performed raw `fetch` calls without proper SSRF mitigation. An attacker could provide a malicious URL to this function, which would then be fetched. The patch replaces the call to the vulnerable helper with `fetchWithSsrFGuard`.

fetchWithGuard

src/media/input-files.ts

The function `fetchWithGuard` contained a custom implementation for fetching URLs with redirects that did not properly sanitize or restrict the URLs being fetched, making it vulnerable to SSRF. The patch replaces the entire vulnerable implementation with a call to the secure `fetchWithSsrFGuard` function.

downloadFile

src/agents/skills-install.ts

The `downloadFile` function directly used `fetch` with a user-controllable URL to download skill files. This could be exploited for SSRF by providing a URL to an internal resource. The fix replaces the direct `fetch` call with `fetchWithSsrFGuard`.

transcribeDeepgramAudio

src/media-understanding/providers/deepgram/audio.ts

This function used `fetchWithTimeout`, a simple wrapper around `fetch` that did not provide SSRF protection. An attacker could potentially exploit this if they could influence the URL being transcribed, especially in configurations not using a custom `baseUrl`. The patch replaces `fetchWithTimeout` with `fetchWithTimeoutGuarded`.

transcribeGeminiAudio

src/media-understanding/providers/google/audio.ts

This function used `fetchWithTimeout`, which directly calls `fetch` without SSRF checks. This is vulnerable if an attacker can control the audio source URL and is not using a custom `baseUrl`. The patch changes the call to `fetchWithTimeoutGuarded` to add SSRF protection.

describeGeminiVideo

src/media-understanding/providers/google/video.ts

Similar to other media understanding functions, `describeGeminiVideo` used the insecure `fetchWithTimeout` function. This could lead to SSRF if the video source URL is attacker-controlled. The fix introduces `fetchWithTimeoutGuarded` to mitigate this.

transcribeOpenAiCompatibleAudio

src/media-understanding/providers/openai/audio.ts

This function was vulnerable to SSRF because it used `fetchWithTimeout`, which does not validate URLs before fetching. The patch replaces this with `fetchWithTimeoutGuarded` to ensure that requests are checked against SSRF policies.

loadWebMedia

src/web/media.ts

This function is an entry point for loading web media. It calls `loadWebMediaInternal` which in turn calls the vulnerable `fetchRemoteMedia` function without applying any SSRF policy. An attacker-provided `mediaUrl` could point to an internal resource, causing an SSRF vulnerability. The patch adds the ability to pass an `ssrfPolicy` down to the fetcher.

resolveSlackMedia

src/slack/monitor/media.ts

This function resolves and fetches media from Slack. It uses `fetchRemoteMedia` which, prior to the patch, was vulnerable to SSRF. The changes in the patch adapt the call to work with the new secure fetching mechanism, but the original call was to the vulnerable function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-wfp2-v9c7-fh79: OpenClaw affected by SSRF via attachment/media URL hydration

Summary

Plain-English Explanation

Affected Packages / Versions

Details

Proof of Concept

Fix

Mitigation

GHSA-wfp2-v9c7-fh79:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

5.9

5.9

GHSA-wfp2-v9c7-fh79: OpenClaw affected by SSRF via attachment/media URL hydration

Summary

Plain-English Explanation

Affected Packages / Versions

Details

Proof of Concept

Fix

Mitigation

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI