# Six OpenClaw Vulnerabilities (SSRF, Webhook Auth Bypass, Path Traversal) incl. CVE-2026-26322, CVE-2026-26319, CVE-2026-26329

> Endor Labs' AI SAST identified six vulnerabilities in the OpenClaw agentic AI assistant: three SSRF flaws (Gateway tool, Urbit auth, Image tool), two fail-open webhook authentication issues (Telnyx, Twilio) and a path traversal in browser upload handling that allows arbitrary local file read. Each was validated with a proof-of-concept and fixed in OpenClaw 2026.2.2 / 2026.2.14; no in-the-wild exploitation is reported.

- **Published:** 2026-11-11T02:52:31Z
- **Last reviewed:** 2026-11-11T02:52:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5718
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5718.png
- **ID:** TL-2026-5718
- **Severity:** HIGH (CVSS 7.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 14
- **CVEs:** CVE-2026-26322, CVE-2026-26319, CVE-2026-26329

## Description

Endor Labs used its AI SAST data-flow analysis to trace untrusted source-to-sink paths in OpenClaw, an open-source agentic AI assistant, and found six vulnerabilities between 2026-02-03 and 2026-02-04. All were validated with working proof-of-concepts and responsibly disclosed to the maintainers on 2026-02-05.

SSRF (CWE-918): (1) Gateway tool SSRF, CVE-2026-26322 / GHSA-g6q9-8fvw-f7rf (CVSS 7.6). In src/agents/tools/gateway.ts, callGatewayTool passes a tool-supplied gatewayUrl through resolveGatewayOptions() into callGateway(), which opens a WebSocket to an arbitrary target without validation. Entry point is POST /tools/invoke with the gateway tool (bearer token required). Impact: probing localhost/internal services, reaching cloud metadata endpoints and bypassing network restrictions. (2) Urbit authentication SSRF, GHSA-pg2v-8xwh-qhcc (no CVE, CVSS 6.5). In extensions/tlon/src/urbit/auth.ts, authenticate(url, code) interpolates the channels.tlon.account.url config value into fetch(`${url}/~/login`) and POSTs the access code as the form body; it requires the attacker to influence configuration. The write-up reports a metadata request confirmed through network monitoring. (3) Image tool SSRF, GHSA-56f2-hvwg-5743 (no CVE, CVSS 7.6). In src/agents/tools/image-tool.ts the image argument matching http(s):// is fetched through loadWebMedia -> loadWebMediaInternal -> fetchRemoteMedia with no allowlist when sandboxRoot is unset; the PoC used POST /v1/responses and the server-side fetch was confirmed by a MIME-type validation error.

Fail-open webhook authentication (CWE-306): (4) Telnyx, CVE-2026-26319 / GHSA-4hg8-92x6-h2f3 (CVSS 7.5, NVD vector AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N). In extensions/voice-call/src/providers/telnyx.ts, TelnyxProvider.verifyWebhook returns { ok: true } when publicKey is unset, so unsigned requests reach event processing. The PoC returned HTTP 200 for a forged call.initiated event at /voice/webhook. Only deployments with the optional @openclaw/voice-call plugin enabled and a reachable webhook endpoint (e.g. a public tunnel or proxy) are affected. Impact: injected call events, manipulated call state/routing, unauthenticated automated actions and DoS through event flooding. (5) Twilio, GHSA-c37p-4qqg-3p76 (no CVE, CVSS 6.5). In extensions/voice-call/src/webhook-security.ts, verifyTwilioWebhook skips validateTwilioSignature() when allowNgrokFreeTierLoopbackBypass is enabled, the verification URL is an ngrok domain and the request appears to come from loopback, which is how ngrok-tunneled requests arrive; external attackers can forge webhooks via the public ngrok URL.

Path traversal (CWE-22): (6) Browser upload, CVE-2026-26329 / GHSA-cv7m-c9jx-vg7q. The browser tool upload action's paths parameter flows through toStringArray() without validation (src/browser/routes/agent.act.ts /hooks/file-chooser handler; src/browser/pw-tools-core.interactions.ts setInputFilesViaPlaywright) into Playwright locator.setInputFiles(), which reads local files. The PoC (POST /tools/invoke, browser tool, upload action, bearer token required) read /etc/passwd and confirmed contents via a snapshot; contents are readable from page JavaScript via FileReader, enabling exfiltration. Endor Labs and Infosecurity Magazine list no CVSS; NVD scores it 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and GitHub CNA 7.1 (CVSS 4.0). Exploitation needs valid Gateway credentials and browser tool permission.

Fixes: the image SSRF was fixed first in 2026.2.2 (commits 81c68f5, 9bd64c8; private/internal IP blocking, hostname validation, redirect hardening, DNS pinning); the remainder in 2026.2.14 (c5406e1 gateway URL restricted to loopback on the configured gateway port or gateway.remote.url; 29b587e and f47584f Telnyx fail-closed with a dev-only skipSignatureVerification option; bfa7d21 Urbit HTTPS-only plus SSRF guard and opt-in channels.tlon.allowPrivateNetwork; ff11d87 Twilio bypass no longer affects signature verification; 3aa94af uploads confined to the OpenClaw temp upload directory). NVD lists all three CVEs as affecting openclaw (node.js) versions before 2026.2.14. The source article reports no in-the-wild exploitation, no IOCs and no attribution; the Endor Labs summary table lists GHSA-4hg8-92x6-h2f3 for both Telnyx and Urbit, while the Urbit section and Infosecurity Magazine give GHSA-pg2v-8xwh-qhcc for Urbit. Infosecurity Magazine separately notes SecurityScorecard reporting of tens of thousands of exposed OpenClaw instances and public exploit code for other OpenClaw CVEs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1565.002 Data Manipulation: Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**OpenClaw Gateway/Image Tool SSRF to Internal or Metadata Target (CVE-2026-26322)** (`TL-2026-5718-SPL-001`)

Detects HTTP requests to OpenClaw /tools/invoke (gateway tool, CVE-2026-26322) and /v1/responses (image tool, GHSA-56f2-hvwg-5743) whose body carries a gatewayUrl argument or an http(s)/ws(s) URL pointing at loopback, RFC1918, link-local cloud metadata (169.254.169.254) or metadata.google.internal. Both flaws let an authenticated caller make the OpenClaw server connect to arbitrary internal targets; versions before 2026.2.14 (image tool: before 2026.2.2) are affected.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1046, T1552.005
- **Data sources:** splunk_stream_http, index=network sourcetype=stream:http, waf_proxy_cef
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="stream:http" http_method=POST (uri_path="/tools/invoke" OR uri_path="/v1/responses")
| eval body=lower(coalesce(form_data, request_body))
| where match(body, "gatewayurl") OR match(body, "image.{1,6}https?://")
| rex field=body "(?<ssrf_target>(?:wss?|https?)://[^ ,]+)"
| where match(ssrf_target, "^(?:wss?|https?)://(?:localhost|127[.]|10[.]|192[.]168[.]|172[.](?:1[6-9]|2[0-9]|3[01])[.]|169[.]254[.]|0[.]0[.]0[.]0|metadata[.]google[.]internal)")
| stats count AS requests min(_time) AS first_seen max(_time) AS last_seen values(uri_path) AS openclaw_endpoints values(ssrf_target) AS ssrf_targets BY src_ip dest_ip
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// OpenClaw gateway-tool / image-tool SSRF (CVE-2026-26322, GHSA-56f2-hvwg-5743); requires WAF/proxy logs with body or matched-data capture
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ "POST"
| where RequestURL has_any ("/tools/invoke", "/v1/responses")
| extend Body = tolower(strcat(RequestURL, " ", AdditionalExtensions, " ", Message))
| where Body has "gatewayurl" or Body matches regex @"image.{1,6}https?://"
| extend SsrfTarget = extract(@"((?:wss?|https?)://[^ ,]+)", 1, Body)
| where SsrfTarget matches regex @"^(?:wss?|https?)://(?:localhost|127\.|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|169\.254\.|0\.0\.0\.0|metadata\.google\.internal)"
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Targets = make_set(SsrfTarget, 20) by SourceIP, DestinationIP, RequestURL
| project FirstSeen, LastSeen, SourceIP, DestinationIP, RequestURL, Requests, Targets
```

### Sigma

```yaml
title: OpenClaw Gateway or Image Tool SSRF Request to Internal Target (CVE-2026-26322)
id: 8f1d2a64-5b7c-4e31-9a0d-571800000001
status: experimental
description: Detects requests to OpenClaw /tools/invoke or /v1/responses that carry a gatewayUrl argument or an internal/metadata address, matching the Gateway tool SSRF (CVE-2026-26322) and Image tool SSRF (GHSA-56f2-hvwg-5743).
references:
    - https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26322
    - https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.discovery
    - attack.t1046
    - attack.credential-access
    - attack.t1552.005
    - cve.2026.26322
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-uri-stem|endswith:
            - '/tools/invoke'
            - '/v1/responses'
    selection_ssrf:
        cs-uri-query|contains:
            - 'gatewayUrl'
            - '169.254.169.254'
            - '127.0.0.1'
            - 'localhost'
            - 'metadata.google.internal'
    condition: selection_endpoint and selection_ssrf
falsepositives:
    - Operators legitimately pointing the gateway tool at the local loopback gateway
    - Internal API testing against the OpenClaw HTTP API
level: high

```

**Known false positives:**

- Operators legitimately pointing the gateway tool at the local loopback gateway on the configured port
- Internal QA or integration tests calling /v1/responses with internal image URLs

**Tuning notes:** Exclude known operator source IPs and the configured gateway.remote.url target. Raise severity when the target is 169.254.169.254 or metadata.google.internal. Requires Splunk Stream (or WAF) body capture on the OpenClaw host; without body logging pivot on the endpoint plus egress detections SPL-003/KQL-002.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] Voice-Call Forged Webhook Accepted (Telnyx/Twilio Fail-Open, CVE-2026-26319) (locked: unlock with TL Creds)
- [indicator] Host Node Process Internal Network Sweep (SSRF Probing) (locked: unlock with TL Creds)
- ngrok Tunnel Exposing [indicator] Voice Webhook (Twilio Loopback Bypass) (locked: unlock with TL Creds)
- [indicator] Webhook Signature Verification Disabled (Insecure Config Flag) (locked: unlock with TL Creds)
- [indicator]/Node Spawned Tool Querying Cloud Metadata (Credential Theft) (locked: unlock with TL Creds)
- Node.js Process Reading Sensitive Files ([indicator] Arbitrary File Read, CVE-2026-26329) (locked: unlock with TL Creds)
- [indicator] Browser Upload Path Traversal / Local File Read (CVE-2026-26329) (locked: unlock with TL Creds)
- [indicator] Host Node Process Accessing Cloud Metadata Service (SSRF Follow-on) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilities (Endor Labs)](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities)
- [Researchers Reveal Six New OpenClaw Vulnerabilities (Infosecurity Magazine)](https://infosecurity-magazine.com/news/researchers-six-new-openclaw)
- [NVD - CVE-2026-26322](https://nvd.nist.gov/vuln/detail/CVE-2026-26322)
- [NVD - CVE-2026-26319](https://nvd.nist.gov/vuln/detail/CVE-2026-26319)
- [NVD - CVE-2026-26329](https://nvd.nist.gov/vuln/detail/CVE-2026-26329)
- [OpenClaw GHSA-g6q9-8fvw-f7rf (Gateway tool SSRF)](https://github.com/openclaw/openclaw/security/advisories/GHSA-g6q9-8fvw-f7rf)
- [OpenClaw GHSA-4hg8-92x6-h2f3 (Telnyx webhook auth)](https://github.com/openclaw/openclaw/security/advisories/GHSA-4hg8-92x6-h2f3)
- [OpenClaw GHSA-cv7m-c9jx-vg7q (browser upload path traversal)](https://github.com/openclaw/openclaw/security/advisories/GHSA-cv7m-c9jx-vg7q)
- [OpenClaw v2026.2.14 release notes](https://github.com/openclaw/openclaw/releases/tag/v2026.2.14)
- [Fix commit c5406e1 (gateway URL override restriction)](https://github.com/openclaw/openclaw/commit/c5406e1d2434be2ef6eb4d26d8f1798d718713f4)
- [Fix commit 3aa94af (browser upload path confinement)](https://github.com/openclaw/openclaw/commit/3aa94afcfd12104c683c9cad81faf434d0dadf87)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5718