Researchers Reveal Six New OpenClaw Vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-26322 +1 in the same advisory: …26319 | OpenClaw is a personal AI assistant. OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Gateway tool accepted a tool-supplied `gatewayUrl` without sufficient restrictions, which could cause the OpenClaw host to attempt outbound WebSocket connections to user-specified targets. This requires the ability to invoke tools that accept `gatewayUrl` overrides (directly or indirectly). In typical setups this is limited to authenticated operators, trusted automation, or environments where tool calls are exposed to non-operators. In other words, this is not a drive-by issue for arbitrary internet users unless a deployment explicitly allows untrusted users to trigger these tool calls. Some tool call paths allowed `gatewayUrl` overrides to flow into the Gateway WebSocket client without validation or allowlisting. This meant the host could be instructed to attempt connections to non-gateway endpoints (for example, localhost services, private network addresses, or cloud metadata IPs). In the common case, this results in an outbound connection attempt from the OpenClaw host (and corresponding errors/timeouts). In environments where the tool caller can observe the results, this can also be used for limited network reachability probing. If the target speaks WebSocket and is reachable, further interaction may be possible. Starting in version 2026.2.14, tool-supplied `gatewayUrl` overrides are restricted to loopback (on the configured gateway port) or the configured `gateway.remote.url`. Disallowed protocols, credentials, query/hash, and non-root paths are rejected. NVD description · AI analysis pending | 7.6 group max | <1% |
| — | ||
| CVE-2026-26329 | OpenClaw is a personal AI assistant. OpenClaw is a personal AI assistant. Prior to version 2026.2.14, authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's `upload` action. The server passed these paths to Playwright's `setInputFiles()` APIs without restricting them to a safe root. An attacker must reach the Gateway HTTP surface (or otherwise invoke the same browser control hook endpoints); present valid Gateway auth (bearer token / password), as required by the Gateway configuration (In common default setups, the Gateway binds to loopback and the onboarding wizard generates a gateway token even for loopback); and have the `browser` tool permitted by tool policy for the target session/context (and have browser support enabled). If an operator exposes the Gateway beyond loopback (LAN/tailnet/custom bind, reverse proxy, tunnels, etc.), the impact increases accordingly. Starting in version 2026.2.14, the upload paths are now confined to OpenClaw's temp uploads root (`DEFAULT_UPLOAD_DIR`) and traversal/escape paths are rejected. NVD description · AI analysis pending | 7.1 | <1% |
| — |
Full article435 words · extracted from infosecurity-magazine.com · click to collapse
OpenClaw has patched six new vulnerabilities in its popular agentic AI assistant, covering server-side request forgery (SSRF), missing authentication and path traversal bugs, according to Endor Labs.
The vulnerabilities, some of which do not have CVE IDs, range from moderate to high severity, the security vendor said in a blog post published on February 18.
The flaws it found are as follows:
- CVE-2026-26322: A Server-Side Request Forgery (SSRF) bug affecting OpenClaw’s Gateway tool, with a CVSS score of 7.6 (high severity)
- CVE-2026-26319: Missing Telnyx webhook authentication with a CVSS score of 7.5 (high severity)
- CVE-2026-26329: Path traversal in browser upload, high severity but with no CVSS score assigned
- A high severity (CVSS 7.6) SSRF vulnerability impacting OpenClaw’s image tool, with the GitHub Security Advisory code of GHSA-56f2-hvwg-5743
- A moderate severity (CVSS 6.5) SSRF vulnerability in Urbit authentication (GHSA-pg2v-8xwh-qhcc)
- A moderate severity (CVSS 6.5) Twilio webhook authentication bypass vulnerability (GHSA-c37p-4qqg-3p76)
Read more on OpenClaw: Hundreds of Malicious Crypto Trading Add-Ons Found in Moltbot/OpenClaw
Endor Labs argued that its research reveals important lessons for developers of AI agent infrastructure.
“Data flow analysis is essential for modern applications,” it said. “The multi-layer architecture of AI agent frameworks means vulnerabilities often span multiple files and components. Understanding the complete source-to-sink path is critical.”
The security vendor also pointed to the following:
- Trust boundaries extend beyond traditional user input. Configuration values, LLM outputs, and tool parameters are potential attack surfaces that require validation
- Validation must occur at every layer for defense in depth. Several vulnerabilities Endor Labs found existed because validation was missing at all stages
- AI-specific patterns require specialized analysis. Traditional static application security testing (SAST) tools designed for regular web app aren’t able to identify issues in LLM-to-tool flows, conversation state management, and agent-specific trust boundaries
OpenClaw Remains an Open Book
Endor Labs revealed last week that it had discovered seven vulnerabilities in total. It’s unclear whether OpenClaw’s development team is still working on a fix for the final one.
In the meantime, major security concerns persist over its undocumented use in the enterprise.
A week ago, a SecurityScorecard report warned of tens of thousands of misconfigured instances that have been exposed to the public internet. This could enable threat actors to gain full access to potentially sensitive corporate systems the OpenClaw instance is able to interact with.
The security vendor also revealed three high-severity CVEs in OpenClaw with public exploit code available for each.
The risk of indirect prompt injection and the presence of malicious “skills” (plugins) on ClawHub are particularly troubling.
Threat actors are already targeting agents with infostealers, it was revealed this week.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/researchers-six-new-openclaw/