CVE-2026-32037: OpenClaw SSRF bypass

CISO Take

OpenClaw's MSTeams media download fails to re-validate redirect hops against its configured mediaAllowHosts allowlist, letting any authenticated Teams user force the agent to make HTTP requests to arbitrary internal hosts. While CVSS scores this at Medium (6.0), the EPSS places it in the top 93rd percentile—a signal of elevated real-world interest—and the changed-scope rating reflects that exploitation extends well beyond the vulnerable component, since AI agents typically hold privileged access to cloud metadata endpoints, internal APIs, and secrets that traditional web apps do not. With no public exploit or CISA KEV entry yet available, the window to patch before weaponization is real but not guaranteed. Upgrade to OpenClaw 2026.2.22 immediately and enforce strict egress filtering on RFC-1918 ranges and cloud metadata IPs from any host running the agent.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (6.0) understates operational risk for AI agent deployments. The changed scope (S:C) combined with the broad internal network access inherent to AI agents elevates practical impact significantly beyond what the score conveys. EPSS top 93rd percentile signals elevated real-world exploitation interest disproportionate to its absolute probability. Attack complexity is rated High—requiring the attacker to influence a URL processed via Teams attachment delivery—but MSTeams provides a low-friction social delivery surface that lowers the effective bar. No public exploit or CISA KEV entry currently exists, but SSRF in agentic download paths has proven straightforward to weaponize once understood.

How does the attack unfold?

Initial Access

Attacker with low-privilege MSTeams access sends an attachment containing a URL pointing to an attacker-controlled server configured to issue redirects to non-allowlisted internal targets.

AML.T0049

Defense Evasion

OpenClaw validates only the original attachment URL against mediaAllowHosts but follows subsequent redirect hops without re-checking, silently bypassing the SSRF allowlist boundary.

AML.T0107

Lateral Movement

The agent's HTTP client reaches a non-allowlisted internal target—cloud metadata service, secrets manager, or RFC-1918 host—via the unchecked redirect chain, leveraging the agent's privileged network position.

AML.T0053

Exfiltration

The internal target's response—containing credentials, tokens, or sensitive configuration data—is returned through the agent to the attacker, enabling further cloud or internal network compromise.

AML.T0086

Initial Access

Attacker with low-privilege MSTeams access sends an attachment containing a URL pointing to an attacker-controlled server configured to issue redirects to non-allowlisted internal targets.

AML.T0049

Defense Evasion

OpenClaw validates only the original attachment URL against mediaAllowHosts but follows subsequent redirect hops without re-checking, silently bypassing the SSRF allowlist boundary.

AML.T0107

Lateral Movement

The agent's HTTP client reaches a non-allowlisted internal target—cloud metadata service, secrets manager, or RFC-1918 host—via the unchecked redirect chain, leveraging the agent's privileged network position.

AML.T0053

Exfiltration

The internal target's response—containing credentials, tokens, or sensitive configuration data—is returned through the agent to the attacker, enabling further cloud or internal network compromise.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.0 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Changed

C Low

I Low

A Low

What should I do?

5 steps

PATCH

Upgrade OpenClaw to ≥2026.2.22 (commits 73d93de, b34097f).
EGRESS FILTERING

Block outbound requests from OpenClaw hosts to RFC-1918 ranges, APIPA (169.254.0.0/16), and cloud metadata IPs at the network layer as a defense-in-depth control.
AUDIT

Review and minimize the mediaAllowHosts allowlist to only necessary external media domains.
DETECT

Alert on HTTP requests from OpenClaw processes targeting internal CIDRs or unexpected external hosts; correlate with Teams attachment ingestion events.
INTERIM WORKAROUND

If patching is delayed, disable MSTeams attachment download functionality in OpenClaw configuration until the upgrade is applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0049 - Exploit Public-Facing Application AML.T0086 - Exfiltration via AI Agent Tool Invocation AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.2 - Mechanisms to prevent or address harmful AI outputs and actions

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32037?

OpenClaw's MSTeams media download fails to re-validate redirect hops against its configured mediaAllowHosts allowlist, letting any authenticated Teams user force the agent to make HTTP requests to arbitrary internal hosts. While CVSS scores this at Medium (6.0), the EPSS places it in the top 93rd percentile—a signal of elevated real-world interest—and the changed-scope rating reflects that exploitation extends well beyond the vulnerable component, since AI agents typically hold privileged access to cloud metadata endpoints, internal APIs, and secrets that traditional web apps do not. With no public exploit or CISA KEV entry yet available, the window to patch before weaponization is real but not guaranteed. Upgrade to OpenClaw 2026.2.22 immediately and enforce strict egress filtering on RFC-1918 ranges and cloud metadata IPs from any host running the agent.

Is CVE-2026-32037 actively exploited?

No confirmed active exploitation of CVE-2026-32037 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32037?

1. PATCH: Upgrade OpenClaw to ≥2026.2.22 (commits 73d93de, b34097f). 2. EGRESS FILTERING: Block outbound requests from OpenClaw hosts to RFC-1918 ranges, APIPA (169.254.0.0/16), and cloud metadata IPs at the network layer as a defense-in-depth control. 3. AUDIT: Review and minimize the mediaAllowHosts allowlist to only necessary external media domains. 4. DETECT: Alert on HTTP requests from OpenClaw processes targeting internal CIDRs or unexpected external hosts; correlate with Teams attachment ingestion events. 5. INTERIM WORKAROUND: If patching is delayed, disable MSTeams attachment download functionality in OpenClaw configuration until the upgrade is applied.

What systems are affected by CVE-2026-32037?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Enterprise chat integrations (Microsoft Teams), Agentic automation pipelines, Cloud-hosted AI agent deployments.

What is the CVSS score for CVE-2026-32037?

CVE-2026-32037 has a CVSS v3.1 base score of 6.0 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksEnterprise chat integrations (Microsoft Teams)Agentic automation pipelinesCloud-hosted AI agent deployments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0086 Exfiltration via AI Agent Tool Invocation

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads. Attackers can supply or influence attachment URLs to force redirects to non-allowlisted targets, bypassing SSRF boundary controls.

Exploitation Scenario

An attacker with a low-privilege Microsoft Teams account identifies a target organization running OpenClaw for AI agent automation. They upload an attachment with a URL pointing to an attacker-controlled server configured to issue a 301 redirect to the AWS instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). OpenClaw validates the initial URL against mediaAllowHosts and passes the check, then follows the redirect without re-validating. The agent retrieves and logs—or returns to the attacker—temporary IAM credentials, enabling cloud resource takeover and lateral movement well beyond the Teams environment.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.