CVE-2026-26322: OpenClaw Package Allows Unrestricted gatewayUrl Override Leading to Potential Security Risks
Summary
CVE-2026-26322: OpenClaw Gateway tool allowed unrestricted gatewayUrl override. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source gateway tool designed to facilitate WebSocket connections for various applications. It allows users to configure gateway settings, enabling seamless communication between clients and servers. However, a recent vulnerability has been identified in versions up to 2026.2.13, where the tool inadequately validates user-supplied gateway URLs, potentially exposing systems to security threats.
Vulnerability Detail
The vulnerability arises from the Gateway tool's acceptance of a user-defined 'gatewayUrl' without proper validation or restrictions. This flaw allows the OpenClaw host to attempt outbound WebSocket connections to arbitrary targets specified by the user. As a result, an attacker could exploit this to probe network reachability or interact with unintended services, leading to unauthorized access or data exposure. The issue is particularly concerning in environments where tool calls are accessible to non-operators, increasing the risk of exploitation.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that only trusted operators have access to invoke tools that accept 'gatewayUrl' overrides. Additionally, consider implementing network-level restrictions to limit access to the OpenClaw service.
Conclusion
The OpenClaw vulnerability CVE-2026-26322 highlights the importance of validating user inputs in software applications. By updating to the patched version and implementing recommended workarounds, users can significantly reduce their exposure to potential security threats.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could allow unauthorized access to internal services, data exposure, or network probing, depending on the attacker's capabilities.
Yes, limiting access to the tool calls and implementing network restrictions can help mitigate the risk until the patch is applied.
You can find more information about OpenClaw on its official repository or documentation site.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
