Six OpenClaw Vulnerabilities (SSRF, Webhook Auth Bypass, Path Traversal) incl. CVE-2026-26322, CVE-2026-26319, CVE-2026-26329

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5718 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: OpenClaw Gateway/Image Tool SSRF to Internal or Metadata Target (CVE-2026-26322)

Detects HTTP requests to OpenClaw /tools/invoke (gateway tool, CVE-2026-26322) and /v1/responses (image tool, GHSA-56f2-hvwg-5743) whose body carries a gatewayUrl argument or an http(s)/ws(s) URL pointing at loopback, RFC1918, link-local cloud metadata (169.254.169.254) or metadata.google.internal. Both flaws let an authenticated caller make the OpenClaw server connect to arbitrary internal targets; versions before 2026.2.14 (image tool: before 2026.2.2) are affected.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1046, T1552.005
• Data sources: splunk_stream_http, index=network sourcetype=stream:http, waf_proxy_cef
• Severity: high
• Confidence: high

Splunk SPL

index=network sourcetype="stream:http" http_method=POST (uri_path="/tools/invoke" OR uri_path="/v1/responses")
| eval body=lower(coalesce(form_data, request_body))
| where match(body, "gatewayurl") OR match(body, "image.{1,6}https?://")
| rex field=body "(?<ssrf_target>(?:wss?|https?)://[^ ,]+)"
| where match(ssrf_target, "^(?:wss?|https?)://(?:localhost|127[.]|10[.]|192[.]168[.]|172[.](?:1[6-9]|2[0-9]|3[01])[.]|169[.]254[.]|0[.]0[.]0[.]0|metadata[.]google[.]internal)")
| stats count AS requests min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS openclaw_endpoints values(ssrf_target) AS ssrf_targets BY src_ip dest_ip
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// OpenClaw gateway-tool / image-tool SSRF (CVE-2026-26322, GHSA-56f2-hvwg-5743); requires WAF/proxy logs with body or matched-data capture
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/tools/invoke", "/v1/responses")
| extend Body = tolower(strcat(RequestURL, " ", AdditionalExtensions, " ", Message))
| where Body has "gatewayurl" or Body matches regex @"image.{1,6}https?://"
| extend SsrfTarget = extract(@"((?:wss?|https?)://[^ ,]+)", 1, Body)
| where SsrfTarget matches regex @"^(?:wss?|https?)://(?:localhost|127\.|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|169\.254\.|0\.0\.0\.0|metadata\.google\.internal)"
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Targets = make_set(SsrfTarget, 20) by SourceIP, DestinationIP, RequestURL
| project FirstSeen, LastSeen, SourceIP, DestinationIP, RequestURL, Requests, Targets

Sigma

title: OpenClaw Gateway or Image Tool SSRF Request to Internal Target (CVE-2026-26322)
id: 8f1d2a64-5b7c-4e31-9a0d-571800000001
status: experimental
description: Detects requests to OpenClaw /tools/invoke or /v1/responses that carry a gatewayUrl argument or an internal/metadata address, matching the Gateway tool SSRF (CVE-2026-26322) and Image tool SSRF (GHSA-56f2-hvwg-5743).
references:
    - https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26322
    - https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.discovery
    - attack.t1046
    - attack.credential-access
    - attack.t1552.005
    - cve.2026.26322
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-uri-stem|endswith:
            - '/tools/invoke'
            - '/v1/responses'
    selection_ssrf:
        cs-uri-query|contains:
            - 'gatewayUrl'
            - '169.254.169.254'
            - '127.0.0.1'
            - 'localhost'
            - 'metadata.google.internal'
    condition: selection_endpoint and selection_ssrf
falsepositives:
    - Operators legitimately pointing the gateway tool at the local loopback gateway
    - Internal API testing against the OpenClaw HTTP API
level: high

Known false positives:

• Operators legitimately pointing the gateway tool at the local loopback gateway on the configured port
• Internal QA or integration tests calling /v1/responses with internal image URLs

Tuning notes: Exclude known operator source IPs and the configured gateway.remote.url target. Raise severity when the target is 169.254.169.254 or metadata.google.internal. Requires Splunk Stream (or WAF) body capture on the OpenClaw host; without body logging pivot on the endpoint plus egress detections SPL-003/KQL-002.

• 🔒 [indicator] Voice-Call Forged Webhook Accepted (Telnyx/Twilio Fail-Open, CVE-2026-26319) · unlock with TL Creds
• 🔒 [indicator] Host Node Process Internal Network Sweep (SSRF Probing) · unlock with TL Creds
• 🔒 ngrok Tunnel Exposing [indicator] Voice Webhook (Twilio Loopback Bypass) · unlock with TL Creds
• 🔒 [indicator] Webhook Signature Verification Disabled (Insecure Config Flag) · unlock with TL Creds
• 🔒 [indicator]/Node Spawned Tool Querying Cloud Metadata (Credential Theft) · unlock with TL Creds
• 🔒 Node.js Process Reading Sensitive Files ([indicator] Arbitrary File Read, CVE-2026-26329) · unlock with TL Creds
• 🔒 [indicator] Browser Upload Path Traversal / Local File Read (CVE-2026-26329) · unlock with TL Creds
• 🔒 [indicator] Host Node Process Accessing Cloud Metadata Service (SSRF Follow-on) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5718.

Technical analysis

Each was validated with a proof-of-concept and fixed in OpenClaw 2026.2.2 / 2026.2.14; no in-the-wild exploitation is reported.

Endor Labs used its AI SAST data-flow analysis to trace untrusted source-to-sink paths in OpenClaw, an open-source agentic AI assistant, and found six vulnerabilities between 2026-02-03 and 2026-02-04. All were validated with working proof-of-concepts and responsibly disclosed to the maintainers on 2026-02-05.

SSRF (CWE-918): (1) Gateway tool SSRF, CVE-2026-26322 / GHSA-g6q9-8fvw-f7rf (CVSS 7.6). In src/agents/tools/gateway.ts, callGatewayTool passes a tool-supplied gatewayUrl through resolveGatewayOptions() into callGateway(), which opens a WebSocket to an arbitrary target without validation. Entry point is POST /tools/invoke with the gateway tool (bearer token required). Impact: probing localhost/internal services, reaching cloud metadata endpoints and bypassing network restrictions. (2) Urbit authentication SSRF, GHSA-pg2v-8xwh-qhcc (no CVE, CVSS 6.5). In extensions/tlon/src/urbit/auth.ts, authenticate(url, code) interpolates the channels.tlon.account.url config value into fetch(`${url}/~/login`) and POSTs the access code as the form body; it requires the attacker to influence configuration. The write-up reports a metadata request confirmed through network monitoring. (3) Image tool SSRF, GHSA-56f2-hvwg-5743 (no CVE, CVSS 7.6). In src/agents/tools/image-tool.ts the image argument matching http(s):// is fetched through loadWebMedia -> loadWebMediaInternal -> fetchRemoteMedia with no allowlist when sandboxRoot is unset; the PoC used POST /v1/responses and the server-side fetch was confirmed by a MIME-type validation error.

Fail-open webhook authentication (CWE-306): (4) Telnyx, CVE-2026-26319 / GHSA-4hg8-92x6-h2f3 (CVSS 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N). In extensions/voice-call/src/providers/telnyx.ts, TelnyxProvider.verifyWebhook returns { ok: true } when publicKey is unset, so unsigned requests reach event processing. The PoC returned HTTP 200 for a forged call.initiated event at /voice/webhook. Only deployments with the optional @openclaw/voice-call plugin enabled and a reachable webhook endpoint (e.g. a public tunnel or proxy) are affected. Impact: injected call events, manipulated call state/routing, unauthenticated automated actions and DoS through event flooding. (5) Twilio, GHSA-c37p-4qqg-3p76 (no CVE, CVSS 6.5). In extensions/voice-call/src/webhook-security.ts, verifyTwilioWebhook skips validateTwilioSignature() when allowNgrokFreeTierLoopbackBypass is enabled, the verification URL is an ngrok domain and the request appears to come from loopback, which is how ngrok-tunneled requests arrive; external attackers can forge webhooks via the public ngrok URL.

Path traversal (CWE-22): (6) Browser upload, CVE-2026-26329 / GHSA-cv7m-c9jx-vg7q. The browser tool upload action's paths parameter flows through toStringArray() without validation (src/browser/routes/agent.act.ts /hooks/file-chooser handler; src/browser/pw-tools-core.interactions.ts setInputFilesViaPlaywright) into Playwright locator.setInputFiles(), which reads local files. The PoC (POST /tools/invoke, browser tool, upload action, bearer token required) read /etc/passwd and confirmed contents via a snapshot; contents are readable from page JavaScript via FileReader, enabling exfiltration. Endor Labs and Infosecurity Magazine list no CVSS; NVD scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and GitHub CNA 7.1 (CVSS 4.0). Exploitation needs valid Gateway credentials and browser tool permission.

Fixes: the image SSRF was fixed first in 2026.2.2 (commits 81c68f5, 9bd64c8; private/internal IP blocking, hostname validation, redirect hardening, DNS pinning); the remainder in 2026.2.14 (c5406e1 gateway URL restricted to loopback on the configured gateway port or gateway.remote.url; 29b587e and f47584f Telnyx fail-closed with a dev-only skipSignatureVerification option; bfa7d21 Urbit HTTPS-only plus SSRF guard and opt-in channels.tlon.allowPrivateNetwork; ff11d87 Twilio bypass no longer affects signature verification; 3aa94af uploads confined to the OpenClaw temp upload directory). NVD lists all three CVEs as affecting openclaw (node.js) versions before 2026.2.14. The source article reports no in-the-wild exploitation, no IOCs and no attribution; the Endor Labs summary table lists GHSA-4hg8-92x6-h2f3 for both Telnyx and Urbit, while the Urbit section and Infosecurity Magazine give GHSA-pg2v-8xwh-qhcc for Urbit. Infosecurity Magazine separately notes SecurityScorecard reporting of tens of thousands of exposed OpenClaw instances and public exploit code for other OpenClaw CVEs.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Discovery

T1046 Network Service Discovery

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Impact

T1565.002 Data Manipulation: Transmitted Data Manipulation

Remediation

Patches

• OpenClaw 2026.2.2 (image tool SSRF, GHSA-56f2-hvwg-5743)
• OpenClaw 2026.2.14 (CVE-2026-26322, CVE-2026-26319, CVE-2026-26329, Urbit SSRF, Twilio bypass)

Immediate actions

• Upgrade OpenClaw to 2026.2.14 or later (2026.2.2 fixes only the image tool SSRF)
• Do not expose the OpenClaw Gateway or voice-call webhook endpoints to the internet; restrict to trusted networks
• Configure the Telnyx publicKey and Twilio auth secrets; treat missing values as a configuration error
• Keep allowNgrokFreeTierLoopbackBypass disabled outside local development

Workarounds

• Disable the optional @openclaw/voice-call plugin if not required
• Restrict /tools/invoke access and bearer tokens to trusted operators
• Do not set skipSignatureVerification: true outside development

Longer-term hardening

• Restrict outbound requests from user-influenced URLs with protocol allowlists, private-IP blocking, hostname validation and redirect controls
• Treat configuration values (e.g. channels.tlon.account.url) as trust boundaries and validate them
• Confine file-upload paths to a dedicated directory and reject traversal sequences and absolute paths
• Block egress from agent hosts to cloud metadata endpoints

Affected and fixed versions

• OpenClaw — OpenClaw (Gateway tool, browser tool, @openclaw/voice-call Telnyx/Twilio providers, tlon/Urbit extension)
  Vulnerable versions: all versions before 2026.2.14 per NVD (CVE-2026-26322, CVE-2026-26319, CVE-2026-26329); image tool SSRF: versions before 2026.2.2
  Fixed in: 2026.2.2 (image tool SSRF); 2026.2.14

Timeline

• 2026-02-03 Endor Labs AI SAST analysis discovers the six OpenClaw vulnerabilities via source-to-sink data-flow tracing
• 2026-02-04 Endor Labs validates each finding with a working proof-of-concept
• 2026-02-05 Responsible disclosure to OpenClaw maintainers
• 2026-02-14 First patch released: OpenClaw 2026.2.2 fixes the Image tool SSRF (per Endor Labs)
• 2026-02-15 OpenClaw 2026.2.14 released fixing the remaining issues; GitHub security advisories published
• 2026-02-18 Endor Labs publishes its technical write-up of the six vulnerabilities
• 2026-02-19 NVD publishes CVE-2026-26322 and CVE-2026-26319; Infosecurity Magazine reports the findings
• 2026-02-20 NVD publishes CVE-2026-26329 (browser upload path traversal; NVD CVSS 6.5)

Sources cited

• NVD - CVE-2026-26322 NVD (NIST) · Advisory · 2026-02-19
• NVD - CVE-2026-26319 NVD (NIST) · Advisory · 2026-02-19
• NVD - CVE-2026-26329 NVD (NIST) · Advisory · 2026-02-20
• How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilities (Endor Labs) endorlabs.com · Research · 2026-02-18
• OpenClaw GHSA-g6q9-8fvw-f7rf (Gateway tool SSRF) GitHub · Vendor report · 2026-02-15
• OpenClaw GHSA-4hg8-92x6-h2f3 (Telnyx webhook auth) GitHub · Vendor report · 2026-02-15
• OpenClaw GHSA-cv7m-c9jx-vg7q (browser upload path traversal) GitHub · Vendor report · 2026-02-15
• OpenClaw v2026.2.14 release notes GitHub · Code repository · 2026-02-15
• Fix commit c5406e1 (gateway URL override restriction) GitHub · Code repository · 2026-02-15
• Fix commit 3aa94af (browser upload path confinement) GitHub · Code repository · 2026-02-15
• Researchers Reveal Six New OpenClaw Vulnerabilities (Infosecurity Magazine) infosecurity-magazine.com · News · 2026-02-19

More in vulnerability

• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)

Previous and next in vulnerability

• OpenClaw apply_patch Path Traversal via LLM Guardrail Bypass (CVE-2026-32060 / GHSA-r5fq-947m-xm57) Previous report
• Critical Fortinet Flaws Expose FortiManager and FortiAnalyzer to Unauthenticated Remote Code Execution (CVE-2026-126170, CVE-2026-126261, CVE-2026-126262, CVE-2026-126260) and Critical FortiOS Flaws Next report

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks