CVE-2026-28476

Publication date

2026-03-05 21:59:51

Family

VulnCheck

State

PUBLISHED

Description

OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence the configured Urbit URL can induce the gateway to make HTTP requests to arbitrary hosts including internal addresses.