Description (CNA)
OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-network requests from the OpenClaw host to loopback, private, or internal destinations.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenClaw / OpenClaw | affected 0 before 2026.3.1 |
CWE
CWE-918
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g99v-8hwm-g76g
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-web-search-citation-redirect
ADP enrichment
No English description supplied.
No references supplied.