CVE-2026-26324: 
Homebrew vulnerability analysis and mitigation

CVE-2026-26324 is a Server-Side Request Forgery (SSRF) protection bypass vulnerability in OpenClaw, an AI assistant platform distributed as an npm package. The flaw allows unauthenticated remote attackers to bypass the application's SSRF guard by supplying full-form IPv4-mapped IPv6 literals (e.g., 0:0:0:0:0:ffff:7f00:1, which resolves to 127.0.0.1), enabling access to loopback addresses, private network ranges, and cloud metadata endpoints that should be blocked. All versions of the openclaw npm package prior to 2026.2.14 are affected. The vulnerability was reported by researcher @yueyueL, disclosed via GitHub Security Advisory on February 15, 2026, and published to the NVD on February 19, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, OpenClaw Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The vulnerable component is the SSRF guard located in src/infra/net/ssrf.ts, specifically the isPrivateIpAddress() function, which failed to consistently detect private IPv4 addresses when they were embedded in IPv6 using full-form IPv4-mapped IPv6 notation. The original code only handled the shorthand ::ffff: prefix form and did not parse full 8-hextet representations such as 0:0:0:0:0:ffff:7f00:1 or 0000:0000:0000:0000:0000:ffff:7f00:0001. The fix rewrote the IPv6 parsing logic to fully expand all hextet forms, extract embedded IPv4 addresses from both IPv4-mapped (::ffff:) and IPv4-compatible (::) IPv6 formats, and then apply private-range checks to the extracted IPv4 value (GitHub Commit, OpenClaw Advisory).

Successful exploitation allows an unauthenticated network attacker to make the OpenClaw server issue requests to internal resources that should be inaccessible, including loopback services (127.0.0.1), private network endpoints (RFC 1918 ranges), and cloud instance metadata services (e.g., 169.254.169.254). The primary impact is high confidentiality loss — an attacker can read sensitive internal data, credentials, or cloud metadata without any privileges or user interaction. There is no direct integrity or availability impact, but access to cloud metadata services could enable credential theft and subsequent lateral movement within cloud-hosted environments (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker against a vulnerable OpenClaw instance. The EPSS score is approximately 0.011% (4th percentile), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing or network-accessible OpenClaw instances running npm package versions prior to 2026.2.14.
2. Identify SSRF-capable input: Locate any OpenClaw feature or API endpoint that accepts a URL or hostname and triggers a server-side HTTP request (e.g., tool invocations, webhook configurations, or URL-fetching agent actions).
3. Craft bypass payload: Instead of using a standard loopback address (127.0.0.1) or shorthand IPv6 (::ffff:127.0.0.1) — which would be blocked — supply a full-form IPv4-mapped IPv6 literal such as 0:0:0:0:0:ffff:7f00:1 or 0000:0000:0000:0000:0000:ffff:7f00:0001 as the target host.
4. Target internal resource: Direct the crafted request to a sensitive internal endpoint, such as the cloud metadata service at 0:0:0:0:0:ffff:a9fe:a9fe (equivalent to 169.254.169.254) to retrieve IAM credentials or instance metadata.
5. Exfiltrate data: Collect the response returned by the OpenClaw server, which may contain sensitive configuration data, internal service responses, or cloud credentials usable for further lateral movement (GitHub Advisory, GitHub Commit).

• Network: Outbound HTTP requests from the OpenClaw server process to 169.254.169.254 (cloud metadata) or loopback/private IP ranges encoded as IPv6 literals (e.g., 0:0:0:0:0:ffff:7f00:1, 0:0:0:0:0:ffff:a9fe:a9fe).
• Logs: Application or access logs showing URL inputs containing full-form IPv4-mapped IPv6 addresses (8-hextet format with ffff in the 6th group) targeting internal ranges; unexpected HTTP responses from internal services appearing in OpenClaw agent output.
• Network: Unusual connections from the OpenClaw host to internal services (databases, admin panels, internal APIs) that would not normally be accessed by the application.
• Process: OpenClaw Node.js process initiating connections to 127.0.0.1, 10.x.x.x, 172.16-31.x.x, or 192.168.x.x ranges via IPv6-encoded addresses.

The primary remediation is to upgrade the openclaw npm package to version 2026.2.14 or later, which contains the fix in commit c0c0e0f9aecb913e738742f73e091f2f72d39a19 that rewrites the SSRF guard to correctly parse and block all forms of IPv4-mapped IPv6 addresses (OpenClaw Release, GitHub Advisory). No official configuration-based workaround is provided; upgrading is the only supported fix. As a defense-in-depth measure, operators should enforce network-level egress filtering on hosts running OpenClaw to block outbound connections to RFC 1918 ranges and cloud metadata endpoints (169.254.169.254) regardless of application-layer controls.

The vulnerability was noted in a BeyondMachines digest covering over 60 security vulnerabilities resolved in the OpenClaw AI assistant release, reflecting the breadth of the security work in version 2026.2.14 (BeyondMachines). A blog post on basefortify.eu discussed the batch of CVEs published for OpenClaw as an "agent reality check," highlighting the security challenges inherent in AI agent platforms. Social media posts on Mastodon and Bluesky from @thehackerwire noted the advisory. No significant vendor statements beyond the official GitHub security advisory have been identified.