Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence the configured Urbit URL can induce the gateway to make HTTP requests to arbitrary hosts including internal addresses.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-06 | 1 | Disclosure1 |
| 2026-03-07 | 3 | Disclosure3 |
| 2026-03-30 | 1 | Disclosure1 |
🔴 OpenClaw, SSRF, #CVE-2026-28476 (High) https://dailycve.com/openclaw-ssrf-cve-2026-28476-high/
Post summary
A new SSRF vulnerability (CVE-2026-28476) in OpenClaw has been disclosed with high severity, but no PoC, exploit, or patch details are provided.
CVE-2026-28476 OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for… https://www.cve.org/CVERecord?id=CVE-2026-28476
Post summary
The text announces a server‑side request forgery vulnerability (CVE-2026‑28476) in OpenClaw's optional Tlon Urbit extension affecting versions prior to 2026.2.14.
🚨 The Hacker Wire 刚刚披露 OpenClaw 低于 2026.2.14 版本的两个高危 CVE：CVE-2026-28476 和 CVE-2026-29610。 这些漏洞直击本地 agent 核心，攻击者轻松劫持你的自动化流程，时间成本直接翻倍，还可能泄露 API key 等敏感数据，赶紧验证版本省大麻烦。 • CVE-2026-28476 是高危服务器端请求伪造漏洞，评分 High。 OpenClaw 可选 Tlon Urbit 扩展直接接受用户提供的 base URL 用于认证，没有任何验证，导致远程攻击者伪造请求访问内部服务。 • CVE-2026-29610 是命令劫持漏洞，同样 High 级别，通过操纵 PATH 环境变量执行任意二进制文件。 具体在 node-host 模块中，攻击者利用这个弱点运行恶意代码，影响所有未更新的安装实例。 💎 卧槽，local AI agent 本该零监视最安全，结果这些 PATH 和 SSRF 坑差点让你的 crypto 监控脚本变黑客后门。 这些 CVE 来自专业安全报告，链接直达详情页（https://www.thehackerwire.com/vulnerability/CVE-2026-28476/ 和 https://www.thehackerwire.com/vulnerability/CVE-2026-29610/），强烈建议拉最新代码检查依赖。 别等到 agent 自己改代码那天发现不对劲，现在 pull v2026.3.2 以上，100+ 修复刚好盖住这些洞，跑起来稳了。你的 http://Pump.fun 监控、Solana meme 刷量啥的，直接免坑续命。 🛡️ OpenClaw 用户别光顾着 Claude 比对，安全更新比功能新奇更救命，昨晚我自己测了 PATH 绕过，确实狠。 🚨 The Hacker Wire just disclosed two high-severity CVEs in OpenClaw versions below 2026.2.14: CVE-2026-28476 and CVE-2026-29610. These flaws hit local agent cores hard—attackers hijack your automations easily, doubling time costs and risking API key leaks. Check your version now to avoid headaches. • CVE-2026-28476 is a high-severity server-side request forgery vulnerability, rated High. OpenClaw's optional Tlon Urbit extension accepts user-supplied base URLs for auth without checks, letting remote attackers forge requests to internal services. • CVE-2026-29610 is a command hijacking flaw, also High, executing arbitrary binaries via PATH manipulation. It targets the node-host module, where attackers exploit this to run malicious code on all unpatched installs. 💎 Damn, local AI agents were supposed to be surveillance-free safest, but these PATH and SSRF holes nearly turn your crypto monitoring scripts into hacker backdoors. Sourced from pro security reports with direct links (https://www.thehackerwire.com/vulnerability/CVE-2026-28476/ and https://www.thehackerwire.com/vulnerability/CVE-2026-29610/). Strongly recommend pulling latest code to verify deps. Don't wait till your agent self-modifies into trouble—grab v2026.3.2+ now, its 100+ fixes seal these exactly. Your http://Pump.fun trackers, Solana meme volume bots? Pit-free forever. 🛡️ OpenClaw folks, skip Claude comparisons—security patches beat shiny features for survival. Tested the PATH bypass last night myself, brutal. #OpenClaw #AICVE #AgentSecurity #LocalAI
Post summary
The post announces two high‑severity CVEs in OpenClaw, explains their exploitation mechanisms, and urges users to update to v2026.3.2+ to remediate the flaws.
🟠 CVE-2026-28476 - High OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without p... https://www.thehackerwire.com/vulnerability/CVE-2026-28476/ https://t.co/dcZwAH1aAZ
Post summary
The post announces the server‑side request forgery vulnerability in OpenClaw's Tlon Urbit extension, notes that versions up to 2026.2.14 are affected, and implies the issue is fixed in that release.
CVE Alert: CVE-2026-28476 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-28476-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-28476 #openclaw #
Post summary
The post merely announces a CVE Alert for CVE‑2026‑28476 with a link but offers no further technical or actionable detail.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |