CVE-2026-35629: OpenClaw SSRF — HIGH

CISO Take

CVE-2026-35629 is an incomplete SSRF remediation in openclaw's channel extensions where multiple handlers still issued raw fetch() calls against configured base URLs, bypassing the guard introduced for the earlier CVE-2026-28476. This is the same package with 67 documented CVEs — a pattern of systemic security debt, not an isolated oversight. Because channel extensions are user- or third-party-configured agent tools, an attacker who can influence extension configuration (including via ClawHub-distributed skills, as documented in AIID #1368) can redirect agent outbound requests to cloud metadata endpoints like AWS IMDS, harvesting IAM credentials without any exploit sophistication. No public exploit or CISA KEV listing exists today, but the trivially low exploitation bar and the sensitive targets reachable (credential endpoints, internal APIs) make this high priority. Upgrade openclaw to 2026.3.28 immediately and enforce egress filtering at the network layer to deny agent host requests to RFC1918 and link-local ranges as defense-in-depth.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High effective risk for cloud-hosted openclaw deployments. SSRF in agent frameworks is disproportionately dangerous because outbound HTTP is core to agent operation, normalizing network egress that masks malicious traffic. The incomplete-fix nature — second SSRF bypass in the same package within a short window — signals inadequate patch validation. No EPSS data is available and the vulnerability is not KEV-listed, but exploitation complexity is trivial: configuring a malicious base URL is sufficient, requiring no memory corruption or auth bypass. Cloud environments with instance metadata services reachable from agent hosts face the highest blast radius.

How does the attack unfold?

Initial Access via Extension

Attacker publishes or compromises an openclaw channel extension on ClawHub with a malicious base URL targeting an internal or cloud metadata endpoint, then induces the victim to install it.

AML.T0010.005

SSRF Exploitation

During normal agent operation, openclaw invokes the channel extension whose unguarded raw fetch() call issues an HTTP request to the malicious base URL, bypassing the SSRF guard.

AML.T0049

Internal Network Probing

Attacker pivots through the SSRF to enumerate internal hosts, reach cloud metadata services (AWS IMDS at 169.254.169.254), and identify high-value internal API endpoints.

AML.T0053

Credential Theft and Lateral Movement

Harvested IAM role credentials or internal API tokens from metadata responses are exfiltrated, enabling the attacker to escalate privileges, access cloud storage, or move laterally within the environment.

AML.T0083

Initial Access via Extension

Attacker publishes or compromises an openclaw channel extension on ClawHub with a malicious base URL targeting an internal or cloud metadata endpoint, then induces the victim to install it.

AML.T0010.005

SSRF Exploitation

During normal agent operation, openclaw invokes the channel extension whose unguarded raw fetch() call issues an HTTP request to the malicious base URL, bypassing the SSRF guard.

AML.T0049

Internal Network Probing

Attacker pivots through the SSRF to enumerate internal hosts, reach cloud metadata services (AWS IMDS at 169.254.169.254), and identify high-value internal API endpoints.

AML.T0053

Credential Theft and Lateral Movement

Harvested IAM role credentials or internal API tokens from metadata responses are exfiltrated, enabling the attacker to escalate privileges, access cloud storage, or move laterally within the environment.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	npm	< 2026.3.28	`2026.3.28`
3 dependents32% patched~5d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CLow

ILow

ALow

What should I do?

4 steps

Patch: Upgrade openclaw to >= 2026.3.28 immediately. The fix routes all channel extension fetch calls through fetchWithSsrFGuard, blocking rebinding to internal destinations.
Network workaround (if patching is delayed): Apply egress ACLs on openclaw agent hosts denying outbound HTTP/HTTPS to RFC1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and loopback addresses.
Audit all configured channel extension base URLs for unexpected internal or metadata destinations.
Detection: Alert on outbound HTTP requests from agent processes targeting 169.254.169.254, internal RFC1918 ranges, or unusual non-public endpoints; correlate with IAM credential issuance events following agent execution.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionAuth BypassSupply ChainAgentPluginAML.T0010.005- AI Agent Tool AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9-Risk management system

ISO 42001

8.4-AI system operation and monitoring

NIST AI RMF

MANAGE 2.2-Mechanisms to sustain AI risk management in deployment

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-35629?

CVE-2026-35629 is an incomplete SSRF remediation in openclaw's channel extensions where multiple handlers still issued raw fetch() calls against configured base URLs, bypassing the guard introduced for the earlier CVE-2026-28476. This is the same package with 67 documented CVEs — a pattern of systemic security debt, not an isolated oversight. Because channel extensions are user- or third-party-configured agent tools, an attacker who can influence extension configuration (including via ClawHub-distributed skills, as documented in AIID #1368) can redirect agent outbound requests to cloud metadata endpoints like AWS IMDS, harvesting IAM credentials without any exploit sophistication. No public exploit or CISA KEV listing exists today, but the trivially low exploitation bar and the sensitive targets reachable (credential endpoints, internal APIs) make this high priority. Upgrade openclaw to 2026.3.28 immediately and enforce egress filtering at the network layer to deny agent host requests to RFC1918 and link-local ranges as defense-in-depth.

Is CVE-2026-35629 actively exploited?

No confirmed active exploitation of CVE-2026-35629 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35629?

1. Patch: Upgrade openclaw to >= 2026.3.28 immediately. The fix routes all channel extension fetch calls through fetchWithSsrFGuard, blocking rebinding to internal destinations. 2. Network workaround (if patching is delayed): Apply egress ACLs on openclaw agent hosts denying outbound HTTP/HTTPS to RFC1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and loopback addresses. 3. Audit all configured channel extension base URLs for unexpected internal or metadata destinations. 4. Detection: Alert on outbound HTTP requests from agent processes targeting 169.254.169.254, internal RFC1918 ranges, or unusual non-public endpoints; correlate with IAM credential issuance events following agent execution.

What systems are affected by CVE-2026-35629?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin integrations, cloud-hosted AI agents.

What is the CVSS score for CVE-2026-35629?

CVE-2026-35629 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin integrationscloud-hosted AI agents

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

## Summary SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476) ## Affected Packages / Versions - Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24` ## Details Several channel extensions still used raw `fetch()` against configured base URLs without the SSRF guard that was added for CVE-2026-28476. Commit `f92c92515bd439a71bd03eb1bc969c1964f17acf` routes those outbound requests through `fetchWithSsrFGuard` so configured endpoints cannot be rebound to blocked internal destinations. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `f92c92515bd439a71bd03eb1bc969c1964f17acf`. ## Fix Commit(s) - `f92c92515bd439a71bd03eb1bc969c1964f17acf`

Exploitation Scenario

An attacker publishes a malicious openclaw channel extension to ClawHub configured with a base URL of http://169.254.169.254/latest/meta-data/iam/security-credentials/. An organization installs the extension as part of a customer support or workflow automation agent. During normal agent operation, the extension's outbound fetch() call — now unguarded — retrieves the AWS IMDS IAM role credentials assigned to the agent host. The extension handler forwards the credential response to an attacker-controlled endpoint embedded in its logic. The attacker uses the harvested temporary AWS credentials to enumerate S3 buckets, exfiltrate training data, or escalate to higher-privileged roles. The victim sees only normal agent traffic patterns.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.