Executive brief
OpenClaw is a web tool library used to fetch and process URLs from user input. When environment proxy variables are configured on the server, the SSRF (Server-Side Request Forgery) guard can be bypassed, allowing an attacker to route requests through a proxy to access internal or private networks that would otherwise be blocked. This could expose sensitive internal services or data.
Technical details
This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition combined with SSRF in the OpenClaw web tools library. The SSRF guard validates the destination hostname and applies policy checks, then selects a request dispatcher; however, when HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are set, the runtime may switch to using EnvHttpProxyAgent instead of the DNS-pinned dispatcher, creating a gap between validation and actual connection routing. This affects functions like web_fetch and citation redirect resolution. An authenticated attacker (or one providing attacker-controlled URLs) in a deployment with proxy environment variables configured can exploit this to route requests through the proxy, bypassing strict pinning and accessing private targets reachable from the proxy environment. The vulnerability is fixed in version 2026.3.2 by enforcing DNS pinning on strict/untrusted URL paths and restricting env-proxy behavior to trusted endpoints via explicit opt-in.
Affected products
- OpenClaw openclaw <= 2026.3.1
Timeline
- 2026-03-03: disclosed: Advisory published
- 2026-03-02: patched: Patch released as version 2026.3.2