AI agent vulnerability · OpenClaw

CVE-2026-27488: OpenClaw hardened cron webhook delivery against SSRF

mediumCVSS 4.0 6.9GHSA-w45g-5746-x9fp

Affected Packages / Versions - openclaw npm package versions <= 2026.2.17. Vulnerability Cron webhook delivery in src/gateway/server-cron.ts used fetch() directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks. Fix Commit(s) - 99db4d13e - 35851cdaf Thanks @Adam55A-code for reporting.

Published Feb 20, 2026 · Updated Feb 23, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.2.17
Fixed in: 2026.2.19
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Affected Packages / Versions

openclaw npm package versions <= 2026.2.17.

Vulnerability

Cron webhook delivery in src/gateway/server-cron.ts used fetch() directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.

Fix Commit(s)

99db4d13e
35851cdaf

Thanks @Adam55A-code for reporting.

Credited to Adam55A-code.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries