Threat video1:00
CVE-2026-26322 OpenClaw SSRF Flaws: Detection & IOCs
Six OpenClaw flaws allow SSRF and webhook auth bypass, patched in 2026.2.14. The 9 detection rules, 14 IOCs and a free Splunk SPL rule cover them.
Read the full threat intel for CVE-2026-26322 OpenClaw SSRF Flaws: Detection & IOCs →
Chapters
- 0:00The hookSix OpenClaw flaws were found and patched.
- 0:04The storyEndor Labs traced untrusted data paths.
- 0:11Attack pathResearchers reproduced an SSRF flaw.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise13 indicators to hunt: 4 URLs, 7 paths and 2 package names.
- 0:38MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to impact.
- 0:43Remediation13 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Six OpenClaw flaws were found and patched.
0:05Endor Labs traced untrusted data paths.
0:08Each was validated, then patched.
0:11Researchers reproduced an SSRF flaw.
0:14Probes reached cloud metadata.
0:16A path traversal in uploads.
0:18Unset keys skipped webhook authentication.
0:21Voice-call events were accepted.
0:26No threat actor: this was defensive research.
0:3113 indicators to hunt: 4 URLs, 7 paths and 2 package names.
0:386 ATT&CK techniques, from initial access to impact.
0:4313 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.