Vulnerability Description
OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence the configured Urbit URL can induce the gateway to make HTTP requests to arbitrary hosts including internal addresses.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.2.14 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/bfa7d21e997baa8e3437657d59b1e296815cPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-pg2v-8xwh-qhccVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-tloThird Party Advisory
FAQ
What is CVE-2026-28476?
CVE-2026-28476 is a vulnerability with a CVSS score of 8.3 (HIGH). OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper val...
How severe is CVE-2026-28476?
CVE-2026-28476 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-28476?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.