Executive brief
OpenClaw is an open-source AI gateway platform that includes a fal provider component for image generation. A server-side request forgery (SSRF) vulnerability in the image download handler allows a malicious or compromised fal relay to fetch internal URLs and expose metadata or service responses. An attacker exploiting this could bypass network isolation and access internal services that should not be directly reachable.
Technical details
The fal provider in OpenClaw used raw, unguarded fetch calls for image download URLs instead of leveraging the existing SSRF-protected fetch path. The vulnerable component is extensions/fal/image-generation-provider.ts. An attacker controlling or compromising a fal relay can craft malicious image URLs pointing to internal services (e.g., localhost, private IP ranges, metadata endpoints). Since the fetch is unauthenticated and unvalidated, the gateway will fetch these internal URLs and return responses through the image pipeline, exposing metadata or service details. The attack requires the fal relay to be compromised or malicious, making it a supply-chain-like threat to deployments using untrusted relays. Fixed in version 2026.3.28 by commit 80d1e8a which implements guarded image fetches.
Affected products
- OpenClaw OpenClaw before 2026.3.28
Timeline
- 2026-03-29: disclosed
- 2026-03-28: patched: Fixed in version 2026.3.28 by commit 80d1e8a