CVE-2026-27488: OpenClaw hardened cron webhook delivery against SSRF
Affected Packages / Versions
- openclaw npm package versions <= 2026.2.17.
Vulnerability Cron webhook delivery in src/gateway/server-cron.ts used fetch() directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.
Fix Commit(s) - 99db4d13e - 35851cdaf
Thanks @Adam55A-code for reporting.
Other sources
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27488?
CVE-2026-27488 has been classified as a significant vulnerability due to potential SSRF exploitation.
How do I fix CVE-2026-27488?
To fix CVE-2026-27488, upgrade the openclaw package to version 2026.2.19 or later.
What does CVE-2026-27488 exploit?
CVE-2026-27488 exploits the fetch() function used in webhook delivery which can access private or internal endpoints.
What versions of openclaw are affected by CVE-2026-27488?
CVE-2026-27488 affects openclaw npm package versions 2026.2.17 and earlier.
What can happen if I am affected by CVE-2026-27488?
If affected by CVE-2026-27488, an attacker could potentially access sensitive internal network endpoints through the application.