Description (CNA)
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| openclaw / openclaw | affected < 2026.2.19 |
CWE
CWE-918
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-w45g-5746-x9fp
- https://github.com/openclaw/openclaw/commit/99db4d13e5c139883ef0def9ff963e9273179655
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.19
ADP enrichment
No English description supplied.
No references supplied.