Executive brief
OpenClaw is an AI automation platform that orchestrates tasks across nodes and gateways. In versions 2026.2.13 through 2026.3.1, the platform failed to validate that camera snapshot and clip files were downloaded from the expected node host. A malicious or compromised partner node could trick the gateway into fetching files from internal network addresses, potentially exposing sensitive internal systems or data. This vulnerability has been patched in version 2026.3.2.
Technical details
OpenClaw contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the camera URL download functionality spanning src/cli/nodes-camera.ts (writeUrlToFile), src/cli/nodes-cli/register.camera.ts, and src/agents/tools/nodes-tool.ts. These code paths accepted camera.snap and camera.clip URL payloads from node configurations and downloaded them without validating the resolved node host. The vulnerability requires authentication (PR:L) and user interaction (UI:R), and has network attack vector. An attacker with access to a paired node could supply arbitrary URLs causing the gateway host to perform outbound requests to internal network destinations, enabling internal network reconnaissance or data exfiltration. The fix (commit 3bf19d6) introduces node-host binding validation, enforces fail-closed behavior when node metadata is unavailable, and implements SSRF-guarded fetch with redirect hostname/protocol validation. Patch available in version 2026.3.2+.
Affected products
- OpenClaw openclaw >= 2026.2.13, <= 2026.3.1
Timeline
- 2026-03-03: disclosed: Security advisory published
- 2026-03-02: patched: Fix commit 3bf19d6f40a0aaa55818b96eede3d05130c02533 authored
- 2026-03-04: other: Advisory modified