~ / search / GHSA-w45g-5746-x9fp

GHSA-w45g-5746-x9fp

OpenClaw hardened cron webhook delivery against SSRF

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-27488

Packages

EcosystemPackageAffectedFixed in
npm openclaw < 2026.2.19 2026.2.19

Details

As written in the advisory (Markdown source, shown as plain text).

## Affected Packages / Versions - `openclaw` npm package versions `<= 2026.2.17`. ## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks. ## Fix Commit(s) - `99db4d13e` - `35851cdaf` Thanks @Adam55A-code for reporting.

References

External links from the advisory. They lead to third-party sites.