CVE-2026-32019: OpenClaw SSRF bypass

CISO Take

OpenClaw's web_fetch functionality fails to block RFC-reserved special-use IPv4 ranges — including 198.18.0.0/15 — due to an incomplete isPrivateIpv4() check, allowing authenticated users to pivot SSRF requests to internal infrastructure that SSRF policy should block. For organizations running AI agents built on OpenClaw, this means a low-privileged attacker can reach cloud metadata services, internal APIs, or adjacent network segments, potentially harvesting instance credentials or mapping internal services. Although no public exploit or active exploitation is confirmed (not in CISA KEV), the EPSS score places this CVE in the 89th percentile for exploitation likelihood — a meaningful signal given the straightforward reversibility of the patch commits and the 4 known downstream dependents. Patch to OpenClaw ≥ 2026.2.22 immediately; as a compensating control, enforce egress network policies on agent hosts to block all RFC-reserved ranges at the infrastructure layer independently of application logic.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High. CVSS 7.4 with Network/Low/Low attack vector reflects ease of exploitation: any authenticated user can trigger it without interaction. SSRF in AI agent frameworks carries amplified blast radius compared to traditional SSRF because agents are typically granted broad outbound network access as a design assumption and may run with elevated cloud IAM roles. The 89th-percentile EPSS score elevates urgency beyond what the absence of a public exploit would suggest. The vulnerability class — incomplete IP blocklist — is trivially reverse-engineered from the three published patch commits, lowering effective exploitation barrier further.

How does the attack unfold?

Initial Access

Attacker with low-privilege user credentials accesses an OpenClaw-powered agent deployment and enumerates available tools, confirming web_fetch is exposed.

AML.T0053

SSRF Policy Bypass

Attacker crafts a URL in the 198.18.0.0/15 RFC-reserved benchmark range; the incomplete isPrivateIpv4() function passes validation, bypassing the intended SSRF policy block.

AML.T0049

Internal Reconnaissance

The agent fetches the target URL on the attacker's behalf, returning responses from internal services — cloud IMDS endpoints, internal APIs, or adjacent microservices — invisible to perimeter SSRF defenses.

AML.T0085.001

Credential Exfiltration

Attacker harvests cloud IAM credentials, internal API tokens, or sensitive service responses from fetch results, enabling lateral movement into cloud infrastructure or internal networks.

AML.T0086

Initial Access

Attacker with low-privilege user credentials accesses an OpenClaw-powered agent deployment and enumerates available tools, confirming web_fetch is exposed.

AML.T0053

SSRF Policy Bypass

Attacker crafts a URL in the 198.18.0.0/15 RFC-reserved benchmark range; the incomplete isPrivateIpv4() function passes validation, bypassing the intended SSRF policy block.

AML.T0049

Internal Reconnaissance

The agent fetches the target URL on the attacker's behalf, returning responses from internal services — cloud IMDS endpoints, internal APIs, or adjacent microservices — invisible to perimeter SSRF defenses.

AML.T0085.001

Credential Exfiltration

Attacker harvests cloud IAM credentials, internal API tokens, or sensitive service responses from fetch results, enabling lateral movement into cloud infrastructure or internal networks.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C Low

I Low

A Low

What should I do?

5 steps

Patch: upgrade OpenClaw to ≥ 2026.2.22 (three commits: 71bd15b, 44dfbd2, 333fbb8, f14ebd7).
Network compensating control: enforce egress firewall rules on agent hosts blocking all RFC-reserved ranges per RFC 6890 — including 198.18.0.0/15 (benchmark), 100.64.0.0/10 (shared address), and 192.0.0.0/24 (IETF protocol) — independently of application-layer checks.
Cloud hardening: enforce IMDSv2 on all AWS agent hosts (session-oriented token requirement significantly limits SSRF-to-credential-theft chains).
Detection: monitor agent outbound HTTP logs for requests to non-routable or RFC-reserved ranges; alert on 2xx responses from 198.18.0.0/15 and other IANA special-use ranges.
If patching is blocked, restrict the web_fetch tool's allowed URL list to an explicit allowlist of known-good external domains via policy configuration.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0085.001 - AI Agent Tools AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - AI risk assessment

NIST AI RMF

MS-2.5 - AI system testing and evaluation

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32019?

OpenClaw's web_fetch functionality fails to block RFC-reserved special-use IPv4 ranges — including 198.18.0.0/15 — due to an incomplete isPrivateIpv4() check, allowing authenticated users to pivot SSRF requests to internal infrastructure that SSRF policy should block. For organizations running AI agents built on OpenClaw, this means a low-privileged attacker can reach cloud metadata services, internal APIs, or adjacent network segments, potentially harvesting instance credentials or mapping internal services. Although no public exploit or active exploitation is confirmed (not in CISA KEV), the EPSS score places this CVE in the 89th percentile for exploitation likelihood — a meaningful signal given the straightforward reversibility of the patch commits and the 4 known downstream dependents. Patch to OpenClaw ≥ 2026.2.22 immediately; as a compensating control, enforce egress network policies on agent hosts to block all RFC-reserved ranges at the infrastructure layer independently of application logic.

Is CVE-2026-32019 actively exploited?

No confirmed active exploitation of CVE-2026-32019 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32019?

1. Patch: upgrade OpenClaw to ≥ 2026.2.22 (three commits: 71bd15b, 44dfbd2, 333fbb8, f14ebd7). 2. Network compensating control: enforce egress firewall rules on agent hosts blocking all RFC-reserved ranges per RFC 6890 — including 198.18.0.0/15 (benchmark), 100.64.0.0/10 (shared address), and 192.0.0.0/24 (IETF protocol) — independently of application-layer checks. 3. Cloud hardening: enforce IMDSv2 on all AWS agent hosts (session-oriented token requirement significantly limits SSRF-to-credential-theft chains). 4. Detection: monitor agent outbound HTTP logs for requests to non-routable or RFC-reserved ranges; alert on 2xx responses from 198.18.0.0/15 and other IANA special-use ranges. 5. If patching is blocked, restrict the web_fetch tool's allowed URL list to an explicit allowlist of known-good external domains via policy configuration.

What systems are affected by CVE-2026-32019?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, multi-agent orchestration, cloud-hosted inference.

What is the CVSS score for CVE-2026-32019?

CVE-2026-32019 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmulti-agent orchestrationcloud-hosted inference

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0085.001 AI Agent Tools

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF policy checks. Attackers with network reachability to special-use IPv4 ranges can exploit web_fetch functionality to access blocked addresses such as 198.18.0.0/15 and other non-global ranges.

Exploitation Scenario

An attacker with a low-privilege account on a SaaS platform or internal tooling stack running OpenClaw-powered AI agents identifies that web_fetch is an available tool. They craft a tool invocation targeting http://198.18.0.1/internal-api — an address in the RFC-2544 benchmark range that isPrivateIpv4() does not block. The agent fetches the URL and returns the response to the attacker, potentially exposing internal service endpoints, authentication tokens, or network topology. On an AWS host without IMDSv2 enforcement, the attacker escalates by similarly fetching cloud IMDS endpoints to harvest temporary IAM credentials, then uses those credentials for lateral movement across the cloud environment — all initiated through a single low-privilege web_fetch invocation.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.