Executive brief
OpenClaw is a framework for deploying and managing AI/automation tools. The Gateway component failed to properly validate URLs supplied by tool callers, potentially allowing authenticated users to redirect the OpenClaw host to make outbound connections to internal networks, private services, or cloud metadata endpoints. This could enable network reconnaissance or service exploitation if the target speaks WebSocket.
Technical details
The vulnerability is a server-side request forgery (SSRF) in OpenClaw's Gateway tool, classified as CWE-918. The root cause is insufficient validation of tool-supplied gatewayUrl parameters that flow into the WebSocket client without allowlisting. An authenticated operator or tool caller can override the gateway URL to point to internal network addresses (localhost, private IPs, cloud metadata IPs), causing the OpenClaw host to initiate outbound connections to attacker-controlled or probed targets. Prerequisites include authenticated tool invocation; unauthenticated internet users cannot exploit this in typical deployments. The impact ranges from connection timeouts to network reachability probing and potential WebSocket interaction with unintended endpoints. Patched in version 2026.2.14, which restricts overrides to loopback or the configured gateway URL and rejects disallowed protocols, credentials, query parameters, and non-root paths.
Affected products
- OpenClaw openclaw <= 2026.2.13
Timeline
- 2026-02-17: disclosed
- 2026-02-14: patched: Patch commit c5406e1d2434be2ef6eb4d26d8f1798d718713f4