CVE-2026-28467: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28467 is a Server-Side Request Forgery (SSRF) vulnerability in the OpenClaw npm package affecting all versions prior to 2026.2.2. The flaw exists in the attachment and media URL hydration mechanism, allowing remote unauthenticated attackers to coerce the OpenClaw gateway into fetching arbitrary HTTP(S) URLs and returning the response bytes as outbound attachments. It was published on March 5, 2026, with patches released in version 2026.2.2 (published February 4, 2026). The vulnerability carries a CVSS v3.1 base score of 8.6 (High) per Feedly threat intelligence data, and 5.9 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery). In affected versions, the remote media fetching code performed a raw fetch(url) call without any SSRF protections — no blocking of private/loopback addresses, no DNS pinning, and no redirect validation (GitHub Advisory). An attacker who can influence the media URL parameter — for example through model-controlled sendAttachment or auto-reply mechanisms — can supply a URL pointing to internal resources such as 127.0.0.1, RFC1918 private addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The gateway then fetches the target URL and delivers the response bytes as an attachment payload, effectively exfiltrating internal data. The fix introduced a fetchWithSsrFGuard wrapper implementing private/loopback/link-local blocking, DNS pinning, and safe redirect handling (Fix Commit 1, Fix Commit 2).

Successful exploitation allows an unauthenticated remote attacker to exfiltrate the contents of internal HTTP(S) endpoints that are reachable from the OpenClaw gateway host, including loopback services, private network resources, and cloud instance metadata endpoints. The primary impact is a high confidentiality loss — sensitive data such as credentials, tokens, configuration files, or internal API responses can be leaked as outbound attachments. There is no direct integrity or availability impact, and the vulnerability does not grant code execution or shell access; however, exfiltrated cloud metadata credentials could enable lateral movement into cloud infrastructure (GitHub Advisory, Feedly).

A proof-of-concept attack sequence is publicly documented in the GitHub Security Advisory, demonstrating that an attacker can supply a malicious internal URL (e.g., http://127.0.0.1:9999/secret.txt) as an attachment/media URL to trigger the SSRF (GitHub Advisory). No authentication is required, and attack complexity is low under CVSS v3.1. There is currently no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term (Feedly).

1. Identify a target: Locate an OpenClaw deployment running a version prior to 2026.2.2 that exposes model-controlled attachment or auto-reply functionality.
2. Identify an influence point: Determine a context where attacker-controlled input can set or influence a media/attachment URL — for example, through a model-controlled sendAttachment call or an auto-reply media URL parameter.
3. Craft a malicious URL: Prepare a URL targeting an internal resource inaccessible from the public internet, such as http://127.0.0.1:9999/secret.txt, http://192.168.1.1/admin, or the cloud metadata endpoint http://169.254.169.254/latest/meta-data/.
4. Trigger the SSRF: Supply the malicious URL as the attachment/media URL in the vulnerable context. The OpenClaw gateway will perform a raw fetch(url) against the internal target without SSRF validation.
5. Receive exfiltrated data: The gateway returns the fetched response bytes as an outbound attachment, delivering the internal resource's content to the attacker (GitHub Advisory).

• Network: Outbound HTTP requests from the OpenClaw gateway process to loopback addresses (127.0.0.1, ::1), RFC1918 private ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), or cloud metadata endpoints (169.254.169.254); unexpected outbound attachment traffic carrying binary or text payloads from internal services.
• Logs: Application logs showing fetch() calls to internal/private URLs during attachment or media hydration; error logs referencing unexpected HTTP responses from loopback or private hosts.
• Process Behavior: The OpenClaw Node.js process initiating TCP connections to internal ports (e.g., port 9999, 8080, 80) that are not part of normal external API communication patterns.
• Attachment Content: Outbound attachments containing content consistent with internal configuration files, API tokens, or cloud metadata responses rather than expected user media (GitHub Advisory).

The primary remediation is to upgrade the openclaw npm package to version 2026.2.2 or later, which introduces SSRF guards including blocking of private/loopback/link-local addresses, DNS pinning, and safe redirect handling (GitHub Advisory, Fix Commit 1). As a network-level workaround prior to patching, implement egress firewall rules on the host running OpenClaw to block outbound connections to RFC1918 private ranges, loopback addresses, and cloud metadata endpoints. Additionally, monitor and log all outbound HTTP requests made by the OpenClaw process to detect anomalous internal-targeting traffic (Feedly).