https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:57:34 +0000 https://vulnerability.circl.lu/vuln/cve-2026-27488 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.</p> https://vulnerability.circl.lu/vuln/cve-2026-27488 https://vulnerability.circl.lu/vuln/ghsa-w45g-5746-x9fp <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` npm package versions `&lt;= 2026.2.17`.</p> <p>## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.</p> <p>## Fix Commit(s) - `99db4d13e` - `35851cdaf`</p> <p>Thanks @Adam55A-code for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` npm package versions `&lt;= 2026.2.17`.</p> <p>## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.</p> <p>## Fix Commit(s) - `99db4d13e` - `35851cdaf`</p> <p>Thanks @Adam55A-code for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-w45g-5746-x9fp