CVE-2026-27488: OpenClaw npm Package Vulnerability in Cron Webhook Delivery
Summary
CVE-2026-27488: OpenClaw hardened cron webhook delivery against SSRF. Affects openclaw versions < 2026.2.19. Fixed in 2026.2.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an npm package designed to facilitate various functionalities in web applications, including cron job management and webhook delivery. It allows developers to automate tasks and integrate with external services through webhooks. However, certain versions of OpenClaw have been found to be vulnerable to Server-Side Request Forgery (SSRF) attacks, which can compromise the security of internal systems.
Vulnerability Detail
The vulnerability arises from the cron webhook delivery mechanism in the OpenClaw package, specifically in the file src/gateway/server-cron.ts. The implementation directly uses the fetch() function to deliver webhooks, which allows attackers to exploit this feature and access private or internal endpoints without proper SSRF policy checks. This could lead to unauthorized access to sensitive data or services within the affected system.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.19
This is the first release that contains the fix.
npm install openclaw@2026.2.19Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your webhook delivery logic to validate the target URLs before making requests. This can help mitigate the risk of SSRF attacks until you can update to the patched version.
Conclusion
In summary, the OpenClaw npm package has a vulnerability related to its cron webhook delivery mechanism, which can lead to SSRF attacks. Users are advised to update to version 2026.2.19 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect against potential exploitation until the update is applied.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate level of severity.
OpenClaw npm package versions 2026.2.17 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to access internal services or sensitive data, leading to potential data breaches or system compromise.
The vulnerability was reported by a user identified as @Adam55A-code.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
