CVE-2026-34504: OpenClaw SSRF — HIGH

CISO Take

OpenClaw's image generation component contains an unguarded SSRF vulnerability that allows a malicious or compromised fal relay to force the agent framework to fetch arbitrary internal URLs, leaking internal service metadata through the image pipeline to attacker-controlled infrastructure. With a scope-changed CVSS of 8.3 and no authentication, privileges, or user interaction required (AV:N/AC:L/PR:N/UI:N/S:C), any OpenClaw deployment integrating fal for image generation is exposed across confidentiality, integrity, and availability simultaneously. The EPSS places this in the top 87th percentile for exploitation likelihood, and the same package carries 396 historical CVEs — a pattern of systemic security debt rather than an isolated finding, amplifying the credibility of near-term exploitation. Upgrade to OpenClaw 2026.3.28 immediately; if patching is blocked, enforce egress filtering to deny outbound connections from OpenClaw to RFC 1918 ranges and cloud metadata endpoints (169.254.169.254, 100.64.0.0/10) at the network layer.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

HIGH risk in AI agent deployments. The network-accessible attack vector with no authentication barrier and scope-changed impact means a single compromised fal relay can pivot into internal infrastructure without any user action. The fal relay acting as an untrusted third-party intermediary is a realistic threat model validated by documented malicious OpenClaw skill abuse in AIID #1368, where 17% of third-party skills were found malicious. The 87th EPSS percentile indicates active researcher interest in this vulnerability class, and the absence of IMDSv2 enforcement in many cloud deployments makes the SSRF-to-credential-theft chain trivially achievable.

How does the attack unfold?

Supply Chain Compromise

Adversary compromises or operates a malicious fal relay endpoint used by OpenClaw as its image generation provider.

AML.T0010.005

SSRF Trigger

User initiates image generation; the malicious relay crafts a response causing OpenClaw's image-generation-provider.ts to issue an unguarded fetch to an internal URL such as a cloud metadata endpoint or internal API service.

AML.T0049

Internal Data Collection

OpenClaw fetches the attacker-specified internal URL and returns the response through the image pipeline to the relay, exposing IAM credentials, API tokens, or internal service data.

AML.T0086

Lateral Movement

Adversary uses harvested internal credentials or service metadata to move laterally within the victim's cloud or on-premise infrastructure, achieving persistent access beyond the original OpenClaw deployment.

AML.T0025

Supply Chain Compromise

Adversary compromises or operates a malicious fal relay endpoint used by OpenClaw as its image generation provider.

AML.T0010.005

SSRF Trigger

User initiates image generation; the malicious relay crafts a response causing OpenClaw's image-generation-provider.ts to issue an unguarded fetch to an internal URL such as a cloud metadata endpoint or internal API service.

AML.T0049

Internal Data Collection

OpenClaw fetches the attacker-specified internal URL and returns the response through the image pipeline to the relay, exposing IAM credentials, API tokens, or internal service data.

AML.T0086

Lateral Movement

Adversary uses harvested internal credentials or service metadata to move laterally within the victim's cloud or on-premise infrastructure, achieving persistent access beyond the original OpenClaw deployment.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 13% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C Low

I Low

A Low

What should I do?

5 steps

Patch: Upgrade to OpenClaw ≥ 2026.3.28 (commit 80d1e8a).
Network egress control: Block outbound HTTP/S from OpenClaw processes to RFC 1918 ranges (10/8, 172.16/12, 192.168/16), link-local (169.254.0.0/16), and cloud metadata IPs — enforce at iptables or Kubernetes NetworkPolicy level.
IMDSv2 enforcement: Enable IMDSv2 on all AWS EC2 instances hosting OpenClaw to mitigate SSRF-to-IMDS credential theft even pre-patch.
Relay audit: Review fal relay configurations for unauthorized endpoint modifications; rotate any credentials or API tokens that may have been accessible from the host.
Detection: Alert on anomalous outbound HTTP requests from image-processing services to internal IP ranges or known metadata endpoints; review proxy or WAF logs for SSRF indicators in image download request paths.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Data Extraction Privacy Violation Agent Plugin API AML.T0010.005 - AI Agent Tool AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI risk assessment

NIST AI RMF

MEASURE 2.5 - The AI system to be deployed is demonstrated to be valid and reliable

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-34504?

OpenClaw's image generation component contains an unguarded SSRF vulnerability that allows a malicious or compromised fal relay to force the agent framework to fetch arbitrary internal URLs, leaking internal service metadata through the image pipeline to attacker-controlled infrastructure. With a scope-changed CVSS of 8.3 and no authentication, privileges, or user interaction required (AV:N/AC:L/PR:N/UI:N/S:C), any OpenClaw deployment integrating fal for image generation is exposed across confidentiality, integrity, and availability simultaneously. The EPSS places this in the top 87th percentile for exploitation likelihood, and the same package carries 396 historical CVEs — a pattern of systemic security debt rather than an isolated finding, amplifying the credibility of near-term exploitation. Upgrade to OpenClaw 2026.3.28 immediately; if patching is blocked, enforce egress filtering to deny outbound connections from OpenClaw to RFC 1918 ranges and cloud metadata endpoints (169.254.169.254, 100.64.0.0/10) at the network layer.

Is CVE-2026-34504 actively exploited?

No confirmed active exploitation of CVE-2026-34504 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34504?

1. Patch: Upgrade to OpenClaw ≥ 2026.3.28 (commit 80d1e8a). 2. Network egress control: Block outbound HTTP/S from OpenClaw processes to RFC 1918 ranges (10/8, 172.16/12, 192.168/16), link-local (169.254.0.0/16), and cloud metadata IPs — enforce at iptables or Kubernetes NetworkPolicy level. 3. IMDSv2 enforcement: Enable IMDSv2 on all AWS EC2 instances hosting OpenClaw to mitigate SSRF-to-IMDS credential theft even pre-patch. 4. Relay audit: Review fal relay configurations for unauthorized endpoint modifications; rotate any credentials or API tokens that may have been accessible from the host. 5. Detection: Alert on anomalous outbound HTTP requests from image-processing services to internal IP ranges or known metadata endpoints; review proxy or WAF logs for SSRF indicators in image download request paths.

What systems are affected by CVE-2026-34504?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI image generation pipelines, multi-modal agent deployments.

What is the CVSS score for CVE-2026-34504?

CVE-2026-34504 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI image generation pipelinesmulti-modal agent deployments

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.

Exploitation Scenario

An adversary compromises a fal relay endpoint via a separate vulnerability or through the supply chain abuse pattern documented in AIID #1368 (malicious OpenClaw third-party skills). When an OpenClaw user triggers image generation, the malicious relay responds with a crafted payload instructing the unguarded image download fetch in image-generation-provider.ts to retrieve an attacker-specified internal URL — for example, http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS or http://internal-k8s-api:8080/api/v1/secrets. OpenClaw fetches the internal URL and returns the response through the image pipeline back to the relay. The adversary harvests the leaked IAM credentials or Kubernetes secrets, then uses them for lateral movement into cloud infrastructure or persistent access — all triggered by a standard image generation workflow with no user awareness.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.