CVE-2026-27488
OpenClaw hardened cron webhook delivery against SSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.
| CWE | CWE-918 |
| Vendor | openclaw |
| Product | openclaw |
| Published | Feb 21, 2026 |
| Last Updated | Feb 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new unknown vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
openclaw / openclaw
< 2026.2.19