CVE-2026-32019: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32019 is an incomplete Server-Side Request Forgery (SSRF) protection bypass in OpenClaw (npm package) affecting all versions prior to 2026.2.22. The vulnerability stems from the isPrivateIpv4() function omitting several RFC-defined special-use and non-global IPv4 ranges from its blocklist, allowing requests to addresses such as 198.18.0.0/15 (RFC 2544 benchmarking), TEST-NET ranges, multicast, and reserved/broadcast blocks to pass through the SSRF guard unchecked. It was disclosed on February 23, 2026, via a GitHub Security Advisory, with CVE assignment following on March 19, 2026. The CVSS v3.1 base score is 5.3 (Medium), while the CVSS v4.0 base score is 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is CWE-918 (Server-Side Request Forgery), specifically an incomplete allowlist/blocklist implementation in src/infra/net/ssrf.ts. The original isPrivateIpv4() function only checked a narrow set of RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16), and CGNAT (100.64.0.0/10), leaving out ranges such as 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 192.0.0.0/24, 192.0.2.0/24, 192.88.99.0/24, multicast (224.0.0.0/4), and reserved (240.0.0.0/4). An attacker could supply a URL targeting one of these omitted ranges to the web_fetch functionality, which would pass SSRF validation and result in the server making an outbound request to the specified address. The fix replaces the ad-hoc octet comparisons with a comprehensive CIDR-based policy table (BLOCKED_IPV4_SPECIAL_USE_CIDRS) and centralizes all IP classification through a single canonical function to prevent classifier drift (GitHub Commit 71bd15b, GitHub Advisory).

Exploitation allows an authenticated attacker with network reachability to RFC-reserved special-use IPv4 ranges to make the OpenClaw server issue HTTP requests to those blocked addresses via web_fetch, potentially accessing internal services, metadata endpoints, or other resources that should be unreachable from external clients. The primary impact is limited confidentiality exposure (low), with no direct integrity or availability impact. In environments where special-use ranges are routed to internal infrastructure (e.g., benchmarking networks, test environments, or misconfigured cloud setups), this could facilitate data exfiltration or reconnaissance of internal services (GitHub Advisory, Feedly).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. Exploitation requires the attacker to be authenticated and to have network-level reachability to the targeted special-use IPv4 ranges, which significantly limits the practical attack surface. The EPSS score is approximately 0.042%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Authenticate: Obtain valid credentials or a session token for an OpenClaw instance running a version prior to 2026.2.22.
2. Identify web_fetch endpoint: Locate the API endpoint or tool invocation path that triggers web_fetch URL fetching functionality within OpenClaw.
3. Craft SSRF payload: Construct a request targeting an RFC special-use IPv4 address not blocked by the original isPrivateIpv4() function, such as http://198.18.0.1/internal (RFC 2544 benchmarking range) or http://198.51.100.1/ (TEST-NET-2).
4. Submit request: Send the crafted request through the authenticated session to the web_fetch functionality. The incomplete SSRF guard passes the address without blocking it.
5. Receive response: If the special-use range is routed to an internal service in the target environment, the server fetches the resource and may return its contents, enabling reconnaissance or data exfiltration (GitHub Commit 71bd15b, GitHub Advisory).

• Network: Outbound HTTP requests from the OpenClaw server process to RFC special-use IPv4 ranges such as 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 192.0.2.0/24, 224.0.0.0/4, or 240.0.0.0/4.
• Logs: Application logs showing web_fetch calls with destination IPs in the above ranges that were not blocked by the SSRF guard (absence of SsrFBlockedError for these addresses in pre-patch versions).
• Process: Unexpected outbound TCP connections initiated by the Node.js OpenClaw process to non-standard internal or special-use IP addresses.

Upgrade OpenClaw (npm) to version 2026.2.22 or later, which replaces the incomplete isPrivateIpv4() function with a comprehensive CIDR-based blocklist covering all RFC special-use ranges and centralizes IP classification to prevent future classifier drift. Four patch commits address the issue: 71bd15b (expand blocked ranges), 44dfbd2 (centralize checks), 333fbb8 (consolidate with ipaddr.js), and f14ebd7 (unify CIDR checks). As a network-level workaround, restrict outbound connectivity from the OpenClaw server to prevent it from reaching RFC special-use ranges at the firewall or network policy layer (GitHub Advisory).

The vulnerability was reported by security researcher @princeeismond-dot and disclosed responsibly through GitHub's security advisory process. The advisory was published by maintainer steipete and rated Low severity. No significant broader media coverage or notable community discussion beyond the GitHub advisory has been identified (GitHub Advisory).