CVE-2026-28476 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.14 contains a server-side request forgery caused by improper validation of user-provided base URLs in the Tlon Urbit extension, letting attackers induce HTTP requests to arbitrary hosts, exploit requires attacker to influence the configured Urbit URL.

Severity & Score

Impact

Attackers can make the server send HTTP requests to arbitrary or internal hosts, potentially accessing internal resources or services.

Mitigation

Update to version 2026.2.14 or later.

References

• https://github.com/openclaw/openclaw/commit/bfa7d21e997baa8e3437657d59b1e296815cc1b1
• https://github.com/openclaw/openclaw/security/advisories/GHSA-pg2v-8xwh-qhcc
• https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-tlon-extension-authentication

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-28476 - High (8.3) OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authentication without proper validation. Attackers who can influence the config... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28476/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner