| status | published | ||||
|---|---|---|---|---|---|
| id | CVE-2026-28476 | ||||
| title | SSRF in Tlon (Urbit) Extension Authentication | ||||
| project | OpenClaw | ||||
| component | extensions/tlon/src/urbit/auth.ts | ||||
| cwe | CWE-918 | ||||
| cvss | 6.3 | ||||
| endor_id | ENDOR-VUL-2026-04022 | ||||
| reported | 2026-02-04 | ||||
| disclosed | 2026-02-18 | ||||
| refs |
|
||||
| blog | https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities | ||||
| credits |
|
Description: The channels.tlon.account.url configuration value flows from monitor/index.ts into authenticate(account.url, account.code), where it is interpolated into fetch(\${url}/~/login`) with no validation of scheme, host, or destination. Anyone able to influence that configuration causes the extension to POST credentials (password=code) to an arbitrary internal or external service. Pointing it at 169.254.169.254` produced a confirmed server-side request to the cloud metadata endpoint.
The trust boundary is the point worth noting: a configuration value is not user input in the traditional sense, but config files, environment variables, and admin interfaces are all reachable, and the value lands in a network sink unchecked. Affects openclaw before 2026.2.14.
Impact: Server-Side Request Forgery with credential disclosure to the attacker-chosen host.
Fixed in commit bfa7d21, which restricts the scheme to HTTPS, adds an SSRF guard blocking private and internal hosts, and gates private networks behind an opt-in channels.tlon.allowPrivateNetwork. The 6.3 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 8.3.