High severity7.5NVD Advisory· Published Feb 19, 2026· Updated Jun 17, 2026

CVE-2026-26324

Description

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, OpenClaw's SSRF protection could be bypassed using full-form IPv4-mapped IPv6 literals such as 0:0:0:0:0:ffff:7f00:1 (which is 127.0.0.1). This could allow requests that should be blocked (loopback / private network / link-local metadata) to pass the SSRF guard. Version 2026.2.14 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.2.14	2026.2.14

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.14
- (no CPE)range: < 2026.2.14
ghsa-coords
pkg:npm/openclaw
Range: < 2026.2.14

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/c0c0e0f9aecb913e738742f73e091f2f72d39a19nvdPatchWEB
github.com/advisories/GHSA-jrvc-8ff5-2f9fghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-jrvc-8ff5-2f9fnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-26324ghsaADVISORY
github.com/openclaw/openclaw/releases/tag/v2026.2.14nvdProductRelease NotesWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000