Junglewise Threat Intelligence

OpenClaw Image Tool server-side request forgery

Severity: low · CVSS 3.1 · Published 2026-02-17

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a popular AI agent platform that includes an Image tool for rendering and fetching remote content. A server-side request forgery (SSRF) vulnerability in the Image tool allows attackers who can invoke the tool to force the platform to make HTTP requests to internal or restricted network addresses, potentially exposing cloud metadata, internal services, or sensitive infrastructure. While exploitability is limited by media-type validation and authentication constraints on some targets, SSRF remains a serious primitive that can enable network reconnaissance and access to unauthenticated internal endpoints.

Technical details

The Image tool in OpenClaw accepts multiple URL schemes (file://, data://, http(s)://). In versions up to 2026.2.1, remote HTTP(S) URLs were fetched without SSRF protections, allowing requests to localhost, RFC1918 private addresses, link-local addresses (169.254.x.x), and cloud metadata endpoints (169.254.169.254). The vulnerability requires attacker-controlled invocation of the Image tool, either through direct tool access or via an untrusted surface that forwards image arguments to tool calls. Exploitation is partially mitigated by media-type validation (the tool expects image/* responses) and by authentication requirements on some metadata services (e.g., AWS IMDSv2 token headers). The fix (commits 81c68f5, 9bd64c8) routes remote media fetches through an SSRF guard implementing private/internal IP blocking, DNS pinning, and redirect hardening. A follow-up commit expanded coverage to skill installer downloads and media understanding provider fetches.

Affected products

  • OpenClaw openclaw <= 2026.2.1

Timeline

  • 2026-02-17: disclosed: Advisory published as GHSA-56f2-hvwg-5743
  • 2026-02-02: patched: Fix committed (81c68f5); patch released in version 2026.2.2

References