CVE-2026-22181: OpenClaw SSRF guard bypass exposes

CISO Take

OpenClaw's URL fetch mechanism fails to enforce DNS pinning when HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are configured, allowing an authenticated attacker to route fetch requests to internal infrastructure that SSRF guards were designed to block. With CVSS 7.6 (High), low attack complexity, and no user interaction required, any low-privilege user with access to an OpenClaw-powered agent can exploit this — and EPSS places it in the top 88th percentile for exploitation likelihood across the CVE population. AI agent deployments in cloud and containerized environments are disproportionately exposed because proxy environment variables are routine in those contexts, meaning cloud metadata endpoints, internal APIs, and credential stores may all be reachable. Patch to OpenClaw 2026.3.2+ immediately; as an interim control, audit and unset HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY from OpenClaw runtime environments and enforce network-layer egress restrictions.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Risk is HIGH in proxy-configured deployments and MEDIUM elsewhere. The combination of network attack vector, low complexity, and low privilege requirements means exploitation is accessible to any authenticated user without specialized tooling. EPSS at the 88th percentile signals elevated real-world exploitation interest relative to the broader CVE population, despite no current public exploit or KEV listing. Cloud and containerized AI agent environments represent the highest-risk tier: proxy variables are commonly set, and cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254) are frequently reachable from within containers. Blast radius is partially bounded by 4 known downstream dependents, but any OpenClaw deployment in an environment with a configured proxy and reachable internal services is directly vulnerable. CWE-918 (SSRF) is a well-understood, high-impact attack class with documented credential-theft chains.

How does the attack unfold?

Initial Access

Authenticated attacker with low-privilege access submits a crafted URL targeting an internal endpoint through an OpenClaw-powered agent's web-fetch interface.

AML.T0049

SSRF Guard Bypass

OpenClaw routes the fetch through the configured HTTP_PROXY or HTTPS_PROXY environment variable instead of applying DNS pinning, silently bypassing the SSRF guard (CWE-918).

AML.T0053

Internal Resource Access

The corporate or cloud proxy forwards the request to the internal target — cloud metadata service, internal API, or credential store — which responds with sensitive data.

Data Exfiltration

The agent returns the internal response to the attacker, exposing IAM credentials, configuration secrets, or internal API data usable for lateral movement without any further exploitation.

AML.T0086

Initial Access

Authenticated attacker with low-privilege access submits a crafted URL targeting an internal endpoint through an OpenClaw-powered agent's web-fetch interface.

AML.T0049

SSRF Guard Bypass

OpenClaw routes the fetch through the configured HTTP_PROXY or HTTPS_PROXY environment variable instead of applying DNS pinning, silently bypassing the SSRF guard (CWE-918).

AML.T0053

Internal Resource Access

The corporate or cloud proxy forwards the request to the internal target — cloud metadata service, internal API, or credential store — which responds with sensitive data.

Data Exfiltration

The agent returns the internal response to the attacker, exposing IAM credentials, configuration secrets, or internal API data usable for lateral movement without any further exploitation.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A Low

What should I do?

5 steps

Patch: Upgrade all OpenClaw instances to 2026.3.2 or later (reference commit 345abf0b).
Workaround (if patching is not immediately possible): Unset HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY environment variables in OpenClaw runtime environments; run env | grep -i proxy on all affected hosts and containers to identify exposure.
Network controls: Apply egress filtering to OpenClaw processes and containers restricting outbound connections to known-good external endpoints; block access to RFC-1918 ranges and cloud metadata addresses (169.254.169.254) at the network layer independent of application-layer guards.
Detection: Audit HTTP fetch logs from OpenClaw processes for requests targeting 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, or cloud metadata paths.
Review downstream dependencies: If your stack depends on any of the 4 known downstream packages consuming OpenClaw, treat them as equally exposed until patched.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

GOVERN 1.2 - Accountability structures for AI risk

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-22181?

OpenClaw's URL fetch mechanism fails to enforce DNS pinning when HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are configured, allowing an authenticated attacker to route fetch requests to internal infrastructure that SSRF guards were designed to block. With CVSS 7.6 (High), low attack complexity, and no user interaction required, any low-privilege user with access to an OpenClaw-powered agent can exploit this — and EPSS places it in the top 88th percentile for exploitation likelihood across the CVE population. AI agent deployments in cloud and containerized environments are disproportionately exposed because proxy environment variables are routine in those contexts, meaning cloud metadata endpoints, internal APIs, and credential stores may all be reachable. Patch to OpenClaw 2026.3.2+ immediately; as an interim control, audit and unset HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY from OpenClaw runtime environments and enforce network-layer egress restrictions.

Is CVE-2026-22181 actively exploited?

No confirmed active exploitation of CVE-2026-22181 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22181?

1. Patch: Upgrade all OpenClaw instances to 2026.3.2 or later (reference commit 345abf0b). 2. Workaround (if patching is not immediately possible): Unset HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY environment variables in OpenClaw runtime environments; run `env | grep -i proxy` on all affected hosts and containers to identify exposure. 3. Network controls: Apply egress filtering to OpenClaw processes and containers restricting outbound connections to known-good external endpoints; block access to RFC-1918 ranges and cloud metadata addresses (169.254.169.254) at the network layer independent of application-layer guards. 4. Detection: Audit HTTP fetch logs from OpenClaw processes for requests targeting 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, or cloud metadata paths. 5. Review downstream dependencies: If your stack depends on any of the 4 known downstream packages consuming OpenClaw, treat them as equally exposed until patched.

What systems are affected by CVE-2026-22181?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-22181?

CVE-2026-22181 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.22%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when environment proxy variables are configured. When HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables are present, attacker-influenced URLs can be routed through proxy behavior instead of pinned-destination routing, enabling access to internal targets reachable from the proxy environment.

Exploitation Scenario

An attacker with a low-privilege account on a SaaS platform backed by OpenClaw submits the URL `http://169.254.169.254/latest/meta-data/iam/security-credentials/` through the agent's web-fetch interface. Under normal conditions, OpenClaw's DNS pinning rejects this internal address. However, the container hosting OpenClaw has HTTP_PROXY set to a corporate forward proxy — a common enterprise configuration — so the request is forwarded through the proxy rather than resolved and pinned directly, bypassing the SSRF guard entirely. The proxy routes the request to the cloud metadata service, which responds with the instance's IAM role credentials. The attacker now holds AWS access keys usable to enumerate S3 buckets, query internal databases, or escalate to additional cloud resources. No exploit code is required — only a crafted URL and awareness that the environment uses a proxy.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.