GitHub Advisoryadvisory · npm

GHSA-w45g-5746-x9fp OpenClaw hardened cron webhook delivery against SSRF

MEDIUM Published 2026-02-20 Modified 2026-02-23 Official page ↗
Aliases
CVE-2026-27488
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L
Weaknesses
CWE-918
Reviewed
2026-02-20

Affected packages

• npm openclaw: < 2026.2.19 → fixed in 2026.2.19

Description

Affected Packages / Versions • `openclaw` npm package versions `<= 2026.2.17`. Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks. Fix Commit(s) • `99db4d13e` • `35851cdaf` Thanks @Adam55A-code for reporting.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References