CVE-2026-27488: 
Homebrew vulnerability analysis and mitigation

CVE-2026-27488 is a Server-Side Request Forgery (SSRF) vulnerability in OpenClaw, a personal AI assistant, affecting the Cron webhook delivery mechanism. The flaw exists in src/gateway/server-cron.ts where the implementation uses fetch() directly without SSRF policy checks, allowing webhook targets to reach private, metadata, and internal endpoints. All OpenClaw npm package versions up to and including 2026.2.17 are affected. The vulnerability was disclosed on February 20, 2026, and carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), stemming from the absence of outbound request validation in the cron webhook delivery path. In src/gateway/server-cron.ts, the code called fetch(webhookTarget.url, ...) directly with no allowlist or blocklist enforcement, meaning any URL — including http://127.0.0.1/, cloud metadata endpoints (e.g., http://169.254.169.254/), or other internal services — could be targeted. The fix introduced a fetchWithSsrFGuard() wrapper from ../infra/net/fetch-guard.js that validates the destination before dispatching the request, throwing a SsrFBlockedError for disallowed targets. No authentication or special privileges are required to trigger the vulnerable code path (GitHub Advisory, Patch Commit).

An attacker who can configure or influence webhook targets in OpenClaw's cron jobs can cause the server to issue HTTP requests to internal or private network endpoints, including cloud instance metadata services, internal APIs, and loopback addresses. This can result in unauthorized disclosure of sensitive information (confidentiality impact), modification of internal resources via state-changing internal API calls (integrity impact), and potential disruption of internal services (availability impact). The vulnerability requires no authentication or user interaction, making it readily exploitable by any network-accessible attacker (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039% (5th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Identify a vulnerable instance: Locate an OpenClaw deployment running npm package version ≤ 2026.2.17 with webhook-enabled cron jobs configured.
2. Configure a malicious webhook target: Through any interface that allows cron job creation or modification (e.g., the OpenClaw configuration or API), set the cron job's delivery.mode to webhook and specify a target URL pointing to an internal endpoint, such as http://169.254.169.254/latest/meta-data/ (AWS metadata) or http://127.0.0.1:<port>/internal-api.
3. Trigger cron job execution: Wait for the scheduled cron job to fire, or force execution if the interface permits. The vulnerable server-cron.ts code will call fetch(webhookTarget.url, { method: 'POST', ... }) without any SSRF validation.
4. Retrieve internal data: The OpenClaw server issues the HTTP POST request to the internal endpoint. Depending on the target, responses may be logged or relayed, exposing sensitive internal data such as cloud credentials, internal service responses, or configuration details (GitHub Advisory, Patch Commit).

• Logs: OpenClaw gateway logs showing cron webhook delivery attempts to RFC-1918 addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x), loopback (127.0.0.1), or cloud metadata IPs (169.254.169.254); log entries with webhookUrl fields containing internal hostnames or metadata service paths.
• Network: Outbound HTTP POST requests from the OpenClaw server process to internal network ranges or metadata endpoints; unexpected connections from the OpenClaw process to ports on localhost or internal hosts.
• Application Behavior: Cron job webhook delivery failures or errors referencing internal/private destinations in application logs; after patching, log entries containing "cron: webhook delivery blocked by SSRF guard" may indicate prior exploitation attempts were occurring (Patch Commit).

Upgrade OpenClaw to version 2026.2.19 or later, which replaces the direct fetch() call with the SSRF-guarded fetchWithSsrFGuard() wrapper in the cron webhook delivery path (GitHub Release). For environments unable to patch immediately, implement network-level egress controls to restrict outbound HTTP requests from the OpenClaw server to approved external endpoints only, and consider disabling webhook delivery functionality if it is not actively required. Monitor webhook delivery logs for any requests targeting internal, loopback, or metadata service addresses (GitHub Advisory).

The vulnerability was reported by community contributor @Adam55A-code and acknowledged in the OpenClaw changelog and release notes for v2026.2.19. The fix was published by maintainer orlyjamie on February 20, 2026. No significant broader media coverage or notable external researcher commentary has been identified beyond the GitHub advisory and standard vulnerability database entries (GitHub Advisory, GitHub Release).