~ / search / GHSA-g99v-8hwm-g76g

GHSA-g99v-8hwm-g76g

OpenClaw has web_search citation redirect SSRF via private-network-allowing policy

Source: GitHub Advisory Database (reviewed) High CVE-2026-31989

Packages

EcosystemPackageAffectedFixed in
npm openclaw < 2026.3.1 2026.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Gemini `web_search` citation redirect resolution used a private-network-allowing SSRF policy. A citation URL redirect could target loopback/private/internal destinations and be fetched by the gateway. ### Impact An attacker who can influence citation redirect targets could trigger internal-network requests from the OpenClaw host. ### Fix Citation redirect resolution now uses strict/default SSRF policy (no private-network override), blocking localhost/private/internal redirect targets. ### Affected and Patched Versions - Affected: `<= 2026.2.26` - Patched: `2026.3.1`

References

External links from the advisory. They lead to third-party sites.