Summary
SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
Affected Packages / Versions
- Package:
openclaw
- Affected versions:
<= 2026.3.24
- First patched version:
2026.3.25
- Latest published npm version at verification time:
2026.3.24
Details
Several channel extensions still used raw fetch() against configured base URLs without the SSRF guard that was added for CVE-2026-28476. Commit f92c92515bd439a71bd03eb1bc969c1964f17acf routes those outbound requests through fetchWithSsrFGuard so configured endpoints cannot be rebound to blocked internal destinations.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit f92c92515bd439a71bd03eb1bc969c1964f17acf.
Fix Commit(s)
f92c92515bd439a71bd03eb1bc969c1964f17acf
References
YLChen-007 Reporter
Summary
SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
Affected Packages / Versions
openclaw<= 2026.3.242026.3.252026.3.24Details
Several channel extensions still used raw
fetch()against configured base URLs without the SSRF guard that was added for CVE-2026-28476. Commitf92c92515bd439a71bd03eb1bc969c1964f17acfroutes those outbound requests throughfetchWithSsrFGuardso configured endpoints cannot be rebound to blocked internal destinations.Verified vulnerable on tag
v2026.3.24and fixed onmainby commitf92c92515bd439a71bd03eb1bc969c1964f17acf.Fix Commit(s)
f92c92515bd439a71bd03eb1bc969c1964f17acfReferences