CVE-2026-31989: OpenClaw SSRF — HIGH

CISO Take

OpenClaw versions before 2026.3.1 contain a server-side request forgery flaw in the web_search tool's citation redirect resolution, allowing any authenticated user with low privileges to force the agent host to make HTTP requests to loopback, private, or internal network destinations — including cloud metadata endpoints like AWS IMDS. With a Scope:Changed CVSS of 7.4 and an EPSS percentile in the top 92%, the exploitation likelihood is statistically elevated relative to the overwhelming majority of published CVEs, even with no confirmed active exploitation or public exploit code at time of publication. Organizations running OpenClaw agents on hosts with reachability to internal APIs, cloud metadata services, or backend AI infrastructure such as internal vector databases face meaningful risk of credential harvesting or internal service enumeration via this path. Upgrade to 2026.3.1 immediately; if patching is delayed, apply host-level egress firewall rules blocking RFC1918, loopback, and link-local ranges from the OpenClaw host, and alert on citation redirect targets resolving to private IP space in web_search logs.

Sources: NVD EPSS GitHub Advisory vulncheck.com ATLAS

What is the risk?

High risk for any deployment where the OpenClaw agent host has non-trivial internal network reachability. The Scope:Changed CVSS component is the critical amplifier here — a compromise of the agent tier can cascade directly into backend infrastructure without requiring additional credential compromise. The low privilege requirement broadens the attacker pool to any authenticated user or compromised low-privilege account. EPSS top 92nd percentile places this in a statistically elevated exploitation likelihood category despite the absence of a public exploit or Nuclei scanner template. Risk is materially reduced for air-gapped deployments or those with strict egress controls on the agent host, but most cloud-hosted agent deployments will be exposed by default.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw with low-privilege credentials or a compromised account to gain the ability to trigger web_search queries with attacker-controlled citation content.

AML.T0012

Tool Exploitation

Attacker injects citation redirect URLs targeting internal network addresses (RFC1918 ranges, loopback, cloud metadata endpoints) into content processed by the web_search tool.

AML.T0049

Internal Network Probing

OpenClaw's citation redirect resolution sends HTTP requests from its host to targeted internal destinations using its privileged network identity, bypassing perimeter controls.

AML.T0075

Data Exfiltration

Responses from internal services — IAM credentials from cloud metadata, internal API data, or vector database contents — are surfaced through citation content or agent output, completing exfiltration.

AML.T0086

Initial Access

Attacker authenticates to OpenClaw with low-privilege credentials or a compromised account to gain the ability to trigger web_search queries with attacker-controlled citation content.

AML.T0012

Tool Exploitation

Attacker injects citation redirect URLs targeting internal network addresses (RFC1918 ranges, loopback, cloud metadata endpoints) into content processed by the web_search tool.

AML.T0049

Internal Network Probing

OpenClaw's citation redirect resolution sends HTTP requests from its host to targeted internal destinations using its privileged network identity, bypassing perimeter controls.

AML.T0075

Data Exfiltration

Responses from internal services — IAM credentials from cloud metadata, internal API data, or vector database contents — are surfaced through citation content or agent output, completing exfiltration.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 8% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I Low

A Low

What should I do?

5 steps

Patch immediately: upgrade OpenClaw to 2026.3.1, which implements a private-network-blocking SSRF policy replacing the previous permissive policy.
Interim egress control: apply firewall rules on the OpenClaw host blocking outbound HTTP/HTTPS to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, and 169.254.0.0/16.
Detection: parse web_search access logs for citation redirect targets matching private IP ranges; alert on HTTP response bodies containing cloud metadata patterns (e.g., 'ami-id', 'instance-id', 'computeMetadata').
Privilege review: restrict web_search tool invocation to the minimum required user set in multi-tenant deployments.
Network segmentation: ensure the OpenClaw agent host cannot reach internal vector databases, LLM inference endpoints, or admin APIs via its default network path.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0067.000 - Citations AML.T0075 - Cloud Service Discovery AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Information security in AI system development

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain oversight are maintained and functional

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-31989?

OpenClaw versions before 2026.3.1 contain a server-side request forgery flaw in the web_search tool's citation redirect resolution, allowing any authenticated user with low privileges to force the agent host to make HTTP requests to loopback, private, or internal network destinations — including cloud metadata endpoints like AWS IMDS. With a Scope:Changed CVSS of 7.4 and an EPSS percentile in the top 92%, the exploitation likelihood is statistically elevated relative to the overwhelming majority of published CVEs, even with no confirmed active exploitation or public exploit code at time of publication. Organizations running OpenClaw agents on hosts with reachability to internal APIs, cloud metadata services, or backend AI infrastructure such as internal vector databases face meaningful risk of credential harvesting or internal service enumeration via this path. Upgrade to 2026.3.1 immediately; if patching is delayed, apply host-level egress firewall rules blocking RFC1918, loopback, and link-local ranges from the OpenClaw host, and alert on citation redirect targets resolving to private IP space in web_search logs.

Is CVE-2026-31989 actively exploited?

No confirmed active exploitation of CVE-2026-31989 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-31989?

1. Patch immediately: upgrade OpenClaw to 2026.3.1, which implements a private-network-blocking SSRF policy replacing the previous permissive policy. 2. Interim egress control: apply firewall rules on the OpenClaw host blocking outbound HTTP/HTTPS to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, and 169.254.0.0/16. 3. Detection: parse web_search access logs for citation redirect targets matching private IP ranges; alert on HTTP response bodies containing cloud metadata patterns (e.g., 'ami-id', 'instance-id', 'computeMetadata'). 4. Privilege review: restrict web_search tool invocation to the minimum required user set in multi-tenant deployments. 5. Network segmentation: ensure the OpenClaw agent host cannot reach internal vector databases, LLM inference endpoints, or admin APIs via its default network path.

What systems are affected by CVE-2026-31989?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, internal AI infrastructure, model serving.

What is the CVSS score for CVE-2026-31989?

CVE-2026-31989 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesinternal AI infrastructuremodel serving

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0067.000 Citations

AML.T0075 Cloud Service Discovery

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-network requests from the OpenClaw host to loopback, private, or internal destinations.

Exploitation Scenario

An attacker with a low-privilege OpenClaw account crafts web content or a document whose embedded citation redirect URLs target internal network addresses — for example, http://169.254.169.254/latest/meta-data/iam/security-credentials/ on an AWS-hosted deployment, or http://internal-qdrant:6333/collections to enumerate a Qdrant vector database backing a RAG pipeline. When the authenticated user or an agent session triggers web_search and OpenClaw resolves those citation redirects, the agent host performs the HTTP request from its own privileged network context, bypassing perimeter controls. The HTTP response from the internal service — potentially containing temporary IAM credentials, internal API schemas, or vector database contents — is surfaced back through the agent's citation rendering, completing the exfiltration without the attacker ever directly touching the internal network.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.