CVE-2026-26322: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26322 is a Server-Side Request Forgery (SSRF) vulnerability in the OpenClaw personal AI assistant's Gateway tool. Prior to version 2026.2.14, the Gateway tool accepted a tool-supplied gatewayUrl parameter without sufficient validation or allowlisting, enabling the OpenClaw host to be directed to make outbound WebSocket connections to arbitrary user-specified targets. Affected versions are all OpenClaw (npm) releases before 2026.2.14 running on Node.js. The vulnerability was disclosed on February 15, 2026, and published to the GitHub Advisory Database on February 17, 2026. It carries a CVSS v3.1 base score of 7.6 (High) (GitHub Advisory, GitHub Security Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where tool call paths in the Gateway WebSocket client passed user-controlled gatewayUrl values directly into outbound connection logic without validation or allowlisting (GitHub Advisory). An authenticated operator or trusted automation user could supply an arbitrary gatewayUrl override — such as ws://169.254.169.254/latest/meta-data/ (cloud metadata endpoint), localhost services, or private network addresses — and the OpenClaw host would attempt a WebSocket connection to that target. The fix, implemented in commit c5406e1, strips user-supplied gatewayUrl values for backend/tool callers by setting url: undefined when the client mode is BACKEND or the client name is GATEWAY_CLIENT, and restricts any remaining overrides to loopback addresses on the configured gateway port or the configured gateway.remote.url (GitHub Commit). Exploitation requires the ability to invoke tools that accept gatewayUrl overrides, which in typical deployments is limited to authenticated operators or trusted automation.

Successful exploitation allows an authenticated attacker to instruct the OpenClaw host to initiate outbound WebSocket connections to arbitrary internal or external targets, including localhost services, private network segments, and cloud metadata endpoints (e.g., 169.254.169.254). In environments where the tool caller can observe connection results, this enables network reachability probing to map internal topology and discover accessible services. If a reachable target speaks WebSocket, further interaction and potential manipulation of that service may be possible, raising risks of unauthorized information disclosure about network configuration, service availability, and sensitive metadata (GitHub Advisory, GitHub Security Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not a drive-by issue for arbitrary internet users — exploitation requires authenticated operator access or the ability to invoke tools that accept gatewayUrl overrides, limiting the attack surface. The EPSS score is approximately 0.012% (0.019% per GitHub Advisory), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 299797 is available for scanning (Tenable).

1. Gain authenticated access: Obtain credentials for an OpenClaw deployment where tool invocation is permitted — either as an authenticated operator, trusted automation account, or in a misconfigured deployment that exposes tool calls to non-operators.
2. Identify a vulnerable tool call path: Locate a tool or agent workflow that accepts a gatewayUrl parameter override (directly or indirectly through the Gateway tool), present in OpenClaw versions ≤ 2026.2.13.
3. Craft a malicious gatewayUrl: Prepare a WebSocket URL pointing to an internal target of interest, such as ws://169.254.169.254:80/latest/meta-data/ (cloud metadata), ws://localhost:<port>/ (local services), or a private network address.
4. Invoke the tool with the malicious URL: Submit a tool call supplying the crafted gatewayUrl override. The OpenClaw host will attempt an outbound WebSocket connection to the specified target without validation.
5. Observe results for network probing: If the tool caller can observe connection outcomes (success, timeout, or error), use the responses to map internal network reachability, identify live services, and enumerate accessible endpoints.
6. Interact with reachable WebSocket targets: If a target is reachable and speaks WebSocket, leverage the established connection for further interaction or data extraction from that service (GitHub Advisory, GitHub Security Advisory).

• Network: Outbound WebSocket connection attempts from the OpenClaw host to unexpected internal addresses (e.g., 169.254.169.254, RFC 1918 ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or localhost/127.0.0.1) on non-standard ports.
• Network: Unusual WebSocket (ws:// or wss://) traffic originating from the OpenClaw process to cloud metadata endpoints or internal services.
• Logs: OpenClaw application logs showing Gateway tool invocations with unexpected or non-configured gatewayUrl values; connection errors or timeouts to internal/private addresses.
• Logs: Tool call audit logs recording gatewayUrl parameters containing IP addresses outside the expected gateway configuration.
• Process: The OpenClaw Node.js process initiating network connections to addresses not matching the configured gateway.remote.url or loopback on the gateway port.

The primary remediation is to upgrade OpenClaw (npm) to version 2026.2.14 or later, which restricts tool-supplied gatewayUrl overrides to loopback addresses on the configured gateway port or the configured gateway.remote.url, and rejects disallowed protocols, credentials, query parameters, hash fragments, and non-root paths (GitHub Release, GitHub Commit). As interim mitigations: restrict tool invocation capabilities to trusted, authenticated operators only; implement egress filtering and network segmentation on the OpenClaw host to block outbound connections to private/metadata IP ranges; and disable or remove tool call exposure to non-operators in deployment configuration. Monitor and log all tool invocations that accept gateway URL parameters to detect abuse (GitHub Advisory).

The vulnerability was part of a broader batch of over 60 security fixes shipped in OpenClaw 2026.2.14, which attracted coverage from security outlets including Infosecurity Magazine and BeyondMachines (Infosecurity Magazine, BeyondMachines). Researchers at Endor Labs highlighted the discovery of six OpenClaw vulnerabilities through AI-assisted SAST data-flow analysis, and the "ClawJacked" attack scenario — where malicious websites hijack local OpenClaw AI agents via WebSocket — received notable coverage from The Hacker News and developer community blogs (Endor Labs, The Hacker News). The CVE appeared in multiple weekly CVE chatter top-ten lists from SOS Intelligence, indicating sustained community interest (SOS Intelligence). The vulnerability was reported by security researcher @p80n-sec and credited in the official advisory and release notes.