https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T07:57:37.703361+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-27488 CVE-2026-27488 — OpenClaw hardened cron webhook delivery against SSRF 2026-10-07T07:57:37.705517+00:00

Affected: openclaw

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.

 https://vulnerability.circl.lu/vuln/ghsa-w45g-5746-x9fp GHSA-w45g-5746-x9fp — OpenClaw hardened cron webhook delivery against SSRF 2026-10-07T07:57:37.705616+00:00

Affected: npm: openclaw

## Affected Packages / Versions

- `openclaw` npm package versions `<= 2026.2.17`.

## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.

## Fix Commit(s) - `99db4d13e` - `35851cdaf`

Thanks @Adam55A-code for reporting.