CVE-2026-27488
OpenClaw hardened cron webhook delivery against SSRF
EPSS 0.02%
Description
## Affected Packages / Versions - `openclaw` npm package versions `<= 2026.2.17`. ## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks. ## Fix Commit(s) - `99db4d13e` - `35851cdaf` Thanks @Adam55A-code for reporting.
How to fix CVE-2026-27488
To remediate CVE-2026-27488, upgrade the affected package to a fixed version below.
- npm/openclaw—upgrade to 2026.2.19 or later
Is CVE-2026-27488 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2026.2.19
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L |