Add the seven OpenClaw findings from the AI SAST campaign

README.md

@@ -25,6 +25,13 @@ Browse the full inventory, including per-finding detail pages and talks:
 | [CVE-2026-41641](https://nvd.nist.gov/vuln/detail/CVE-2026-41641) | 2026-04-22 | NocoBase | 7.2 | ENDOR-VUL-2026-16042 · [Writeup](https://www.endorlabs.com/learn/hacking-your-life-with-ai-can-get-you-hacked) · [DEF CON 34](https://www.p80n.com/#hacking-your-life-with-ai) |
 | [CVE-2026-30898](https://nvd.nist.gov/vuln/detail/CVE-2026-30898) | 2026-04-17 | Apache Airflow | 8.8 | ENDOR-VUL-2026-0503 · [Writeup](https://www.endorlabs.com/learn/hacking-your-life-with-ai-can-get-you-hacked) · [DEF CON 34](https://www.p80n.com/#hacking-your-life-with-ai) |
 | [CVE-2026-27959](https://nvd.nist.gov/vuln/detail/CVE-2026-27959) | 2026-02-26 | Koa | 7.5 | ENDOR-VUL-2026-2301 · [Writeup](https://www.endorlabs.com/learn/cve-2026-27959-koa) |
+| [CVE-2026-32060](https://nvd.nist.gov/vuln/detail/CVE-2026-32060) | 2026-02-19 | OpenClaw | 8.7 | ENDOR-VUL-2026-04027 · [Writeup](https://www.endorlabs.com/learn/ai-sast-finding-path-traversal-in-openclaw-via-llm-guardrail-bypass) |
+| [CVE-2026-26329](https://nvd.nist.gov/vuln/detail/CVE-2026-26329) | 2026-02-18 | OpenClaw | 7.1 | ENDOR-VUL-2026-04026 · [Writeup](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities) |
+| [CVE-2026-28476](https://nvd.nist.gov/vuln/detail/CVE-2026-28476) | 2026-02-18 | OpenClaw | 6.3 | ENDOR-VUL-2026-04022 · [Writeup](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities) |
+| [CVE-2026-29606](https://nvd.nist.gov/vuln/detail/CVE-2026-29606) | 2026-02-18 | OpenClaw | 6.3 | ENDOR-VUL-2026-04024 · [Writeup](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities) |
+| [CVE-2026-26319](https://nvd.nist.gov/vuln/detail/CVE-2026-26319) | 2026-02-17 | OpenClaw | 7.5 | ENDOR-VUL-2026-04021 · [Writeup](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities) |
+| [CVE-2026-26322](https://nvd.nist.gov/vuln/detail/CVE-2026-26322) | 2026-02-17 | OpenClaw | 7.6 | ENDOR-VUL-2026-04025 · [Writeup](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities) |
+| [GHSA-56f2-hvwg-5743](https://github.com/advisories/GHSA-56f2-hvwg-5743) | 2026-02-17 | OpenClaw | 7.6 | ENDOR-VUL-2026-04023 · [Writeup](https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities) |
 | [CVE-2025-63662](https://nvd.nist.gov/vuln/detail/CVE-2025-63662) | 2025-12-22 | GT Edge AI Platform | 7.5 | [Writeup](https://gist.github.com/p80n-sec/48ce34c929e8b946f0ad25f76e7b8cef) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |
 | [CVE-2025-63663](https://nvd.nist.gov/vuln/detail/CVE-2025-63663) | 2025-12-22 | GT Edge AI Platform | 7.5 | [Writeup](https://gist.github.com/p80n-sec/f3ca933480157cb4e18c387d92f4d0c2) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |
 | [CVE-2025-63664](https://nvd.nist.gov/vuln/detail/CVE-2025-63664) | 2025-12-22 | GT Edge AI Platform | 7.5 | [Writeup](https://gist.github.com/p80n-sec/0a0a71a2190d5e6f8083bf6069e7b5f2) · [BSides NoVA 2025](https://www.p80n.com/#attacking-ai-applications) · [CackalackyCon 2026](https://www.p80n.com/#from-ctfs-to-cves) |

findings/CVE-2026-26319/finding.md

@@ -0,0 +1,37 @@
+---
+status: published
+id: CVE-2026-26319
+title: Missing Telnyx Webhook Authentication
+project: OpenClaw
+component: extensions/voice-call/src/providers/telnyx.ts
+cwe: CWE-306
+cvss: 7.5
+endor_id: ENDOR-VUL-2026-04021
+reported: 2026-02-04
+disclosed: 2026-02-17
+refs:
+  nvd: https://nvd.nist.gov/vuln/detail/CVE-2026-26319
+  ghsa: https://github.com/advisories/GHSA-4hg8-92x6-h2f3
+blog: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: `TelnyxProvider.verifyWebhook()` fails open. When `publicKey` is unset it returns `{ ok: true }` before reaching any signature check, so an HTTP POST to the voice-call webhook flows through `handleRequest()` into `parseWebhookEvent()` and `processEvent()` with no verification at all:
+
+```ts
+verifyWebhook(ctx: WebhookContext): WebhookVerificationResult {
+  if (!this.publicKey) {
+    // No public key configured, skip verification (not recommended for production)
+    return { ok: true };
+  }
+  const signature = ctx.headers["telnyx-signature-ed25519"];
+  // …never reached
+}
+```
+
+The comment acknowledges the risk and the default configuration ships into it. Affects openclaw before 2026.2.14.
+
+Impact: Unauthenticated webhook processing. Any caller who can reach the endpoint drives voice-call event handling as though Telnyx had signed the request.
+
+Found by Endor Labs AI SAST tracing the data flow from the webhook route to the fail-open return.

findings/CVE-2026-26322/finding.md

@@ -0,0 +1,34 @@
+---
+status: published
+id: CVE-2026-26322
+title: SSRF via Unrestricted gatewayUrl Override in the Gateway Tool
+project: OpenClaw
+component: src/agents/tools/gateway.ts
+cwe: CWE-918
+cvss: 7.6
+endor_id: ENDOR-VUL-2026-04025
+reported: 2026-02-04
+disclosed: 2026-02-17
+refs:
+  nvd: https://nvd.nist.gov/vuln/detail/CVE-2026-26322
+  ghsa: https://github.com/advisories/GHSA-g6q9-8fvw-f7rf
+blog: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: The `gatewayUrl` tool argument from Gateway, Canvas, and Cron invocations flows through `resolveGatewayOptions()` into `callGateway()` and reaches `new WebSocket(url)` unvalidated. Three separate controls are missing: no protocol allowlist, no host validation, and no IP restriction on RFC1918, loopback, or cloud metadata ranges.
+
+```
+{ "tool": "gateway", "gatewayUrl": "ws://169.254.169.254" }
+  -> resolveGatewayOptions(opts)
+  -> gateway = { url: opts.gatewayUrl, ... }
+  -> callGateway({ url: gateway.url })
+  -> new WebSocket(url)     // no validation
+```
+
+Confirmed by invoking the Gateway tool against controlled test infrastructure and observing the outbound WebSocket connection. Affects openclaw before 2026.2.14.
+
+Impact: Server-Side Request Forgery. Probes internal services, reaches cloud metadata endpoints, and bypasses network-level restrictions.
+
+Fixed in commit `c5406e1`, which restricts Gateway URL overrides to loopback on the configured gateway port or the explicitly configured `gateway.remote.url`, and rejects disallowed protocols, embedded credentials, query strings, and non-root paths.

findings/CVE-2026-26329/finding.md

@@ -0,0 +1,34 @@
+---
+status: published
+id: CVE-2026-26329
+title: Path Traversal in Browser Upload Allows Arbitrary Local File Read
+project: OpenClaw
+component: src/browser/pw-tools-core.interactions.ts
+cwe: CWE-22
+cvss: 7.1
+endor_id: ENDOR-VUL-2026-04026
+reported: 2026-02-04
+disclosed: 2026-02-18
+refs:
+  nvd: https://nvd.nist.gov/vuln/detail/CVE-2026-26329
+  ghsa: https://github.com/advisories/GHSA-cv7m-c9jx-vg7q
+blog: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: The `paths` parameter of the browser upload action travels from `POST /tools/invoke` through the browser tool dispatch, the `/hooks/file-chooser` route, and `toStringArray()` in `src/browser/routes/agent.act.ts` into `setInputFilesViaPlaywright()`, where `locator.setInputFiles(opts.paths)` reads whatever it is given. No layer validates the path.
+
+```
+POST /tools/invoke
+{ "tool": "browser", "action": "upload", "args": { "paths": ["/etc/passwd"] } }
+  -> browser-tool.ts:603-635
+  -> routes/agent.act.ts:335-365   const paths = toStringArray(body.paths)   // no validation
+  -> pw-tools-core.interactions.ts:531   await locator.setInputFiles(opts.paths)
+```
+
+Four boundaries are crossed with no check at any of them: HTTP parsing and routing, tool dispatch, the browser control IPC boundary, and the Playwright call. That makes it systemic rather than a single missed guard. Affects openclaw before 2026.2.14.
+
+Impact: Arbitrary local file read, exfiltrated through a file input on an attacker-chosen page.
+
+No CVSS was assigned when the advisory published; the 7.1 recorded here is the CVSS v4.0 score carried on it now, and no v3.1 score has been assigned.

findings/CVE-2026-28476/finding.md

@@ -0,0 +1,26 @@
+---
+status: published
+id: CVE-2026-28476
+title: SSRF in Tlon (Urbit) Extension Authentication
+project: OpenClaw
+component: extensions/tlon/src/urbit/auth.ts
+cwe: CWE-918
+cvss: 6.3
+endor_id: ENDOR-VUL-2026-04022
+reported: 2026-02-04
+disclosed: 2026-02-18
+refs:
+  nvd: https://nvd.nist.gov/vuln/detail/CVE-2026-28476
+  ghsa: https://github.com/advisories/GHSA-pg2v-8xwh-qhcc
+blog: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: The `channels.tlon.account.url` configuration value flows from `monitor/index.ts` into `authenticate(account.url, account.code)`, where it is interpolated into `fetch(\`\${url}/~/login\`)` with no validation of scheme, host, or destination. Anyone able to influence that configuration causes the extension to POST credentials (`password=code`) to an arbitrary internal or external service. Pointing it at `169.254.169.254` produced a confirmed server-side request to the cloud metadata endpoint.
+
+The trust boundary is the point worth noting: a configuration value is not user input in the traditional sense, but config files, environment variables, and admin interfaces are all reachable, and the value lands in a network sink unchecked. Affects openclaw before 2026.2.14.
+
+Impact: Server-Side Request Forgery with credential disclosure to the attacker-chosen host.
+
+Fixed in commit `bfa7d21`, which restricts the scheme to HTTPS, adds an SSRF guard blocking private and internal hosts, and gates private networks behind an opt-in `channels.tlon.allowPrivateNetwork`. The 6.3 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 8.3.

findings/CVE-2026-29606/finding.md

@@ -0,0 +1,35 @@
+---
+status: published
+id: CVE-2026-29606
+title: Twilio Voice-Call Webhook Auth Bypass via ngrok Loopback Compatibility
+project: OpenClaw
+component: extensions/voice-call/src/webhook-security.ts
+cwe: CWE-306
+cvss: 6.3
+endor_id: ENDOR-VUL-2026-04024
+reported: 2026-02-04
+disclosed: 2026-02-18
+refs:
+  nvd: https://nvd.nist.gov/vuln/detail/CVE-2026-29606
+  ghsa: https://github.com/advisories/GHSA-c37p-4qqg-3p76
+blog: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: `verifyTwilioWebhook()` treats a loopback `remoteAddress` as evidence that a request is local and trusted. It is not. The ngrok agent forwards requests from the public webhook URL to the local server, so a request that originated anywhere on the internet arrives with a loopback source address:
+
+```ts
+const isNgrokFreeTier =
+  verificationUrl.includes('.ngrok-free.app') || verificationUrl.includes('.ngrok.io');
+
+if (isNgrokFreeTier && options?.allowNgrokFreeTierLoopbackBypass && isLoopbackAddress(ctx.remoteAddress)) {
+  return { ok: true, reason: 'ngrok free tier compatibility mode (loopback only)' };
+}
+```
+
+With `allowNgrokFreeTierLoopbackBypass` enabled, `validateTwilioSignature()` is skipped entirely. The control that was meant to narrow the bypass to local callers is the thing the proxy defeats. Affects openclaw before 2026.2.14.
+
+Impact: Unauthenticated webhook processing whenever the ngrok compatibility mode is on.
+
+The 6.3 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 6.5.

findings/CVE-2026-32060/finding.md

@@ -0,0 +1,38 @@
+---
+status: published
+id: CVE-2026-32060
+title: Path Traversal in apply_patch via LLM Guardrail Bypass
+project: OpenClaw
+component: src/agents/apply-patch.ts
+cwe: CWE-22
+cvss: 8.7
+endor_id: ENDOR-VUL-2026-04027
+reported: 2026-02-04
+disclosed: 2026-02-19
+refs:
+  nvd: https://nvd.nist.gov/vuln/detail/CVE-2026-32060
+  ghsa: https://github.com/advisories/GHSA-r5fq-947m-xm57
+blog: https://www.endorlabs.com/learn/ai-sast-finding-path-traversal-in-openclaw-via-llm-guardrail-bypass
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: Patch text supplied to the `apply_patch` tool flows through `parsePatchText()` into `hunk.path` and `resolvePatchPath()`. That function branches on whether `sandboxRoot` is configured: when it is, `assertSandboxPath()` blocks traversal correctly; when it is not, which is the default, `resolvePathFromCwd()` accepts absolute paths and `../` segments and hands the result to `fs.writeFile` and `fs.rm` with no confinement.
+
+```ts
+if (hunk.kind === "add") {
+  const target = await resolvePatchPath(hunk.path, options);
+  await ensureDir(target.resolved);
+  await fs.writeFile(target.resolved, hunk.contents, "utf8");
+}
+if (hunk.kind === "delete") {
+  const target = await resolvePatchPath(hunk.path, options);
+  await fs.rm(target.resolved);
+}
+```
+
+What makes this one worth reading on its own is the reachability. The sink is only reachable through LLM-mediated tool execution, so the model's safety guardrails are the sole runtime control standing in front of it, and those guardrails fall to fabricated conversation history injected through the API. A classic CWE-22 sitting behind an LLM guardrail bypass. Affects openclaw through 2026.2.13.
+
+Impact: Arbitrary file write and delete outside the workspace.
+
+Advisory published 2026-02-19, separately from the other six. The 8.7 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 8.8.

findings/GHSA-56f2-hvwg-5743/finding.md

@@ -0,0 +1,25 @@
+---
+status: published
+id: GHSA-56f2-hvwg-5743
+title: SSRF in Image Tool Remote Fetch
+project: OpenClaw
+component: src/agents/tools/image-tool.ts
+cwe: CWE-918
+cvss: 7.6
+endor_id: ENDOR-VUL-2026-04023
+reported: 2026-02-04
+disclosed: 2026-02-17
+refs:
+  ghsa: https://github.com/advisories/GHSA-56f2-hvwg-5743
+blog: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+credits:
+  - Peyton Kennedy (p80n)
+---
+
+Description: The `image` tool argument flows through `createImageTool.execute()` into `loadWebMedia()`, then `loadWebMediaInternal()`, then `fetchRemoteMedia()`, and reaches `fetch(url)` with no allowlist and no network restriction when `sandboxRoot` is unset. URL detection is a regex (`/^https?:\/\//i`) and nothing validates the destination between that test and the request.
+
+The server-side fetch was confirmed through the error response: a MIME-type validation failure proves the fetch happened even though the payload was not an image. Affects openclaw before 2026.2.2.
+
+Impact: Server-Side Request Forgery reaching internal services and cloud metadata endpoints from a single tool invocation.
+
+Fixed in commits `81c68f5` and `9bd64c8`, which route remote media through SSRF guards with private and internal IP blocking, hostname validation, redirect hardening, and DNS pinning. First of the batch to be patched, in 2026.2.2, ahead of the rest in 2026.2.14. No CVE was assigned.

links.yml

@@ -10,3 +10,11 @@
   kind: whitepaper
   url: https://www.endorlabs.com/learn/how-ai-orchestration-platforms-ship-rce-by-design
   date: 2026-08-18
+- title: "How AI SAST Traced Data Flows to Uncover Six OpenClaw Vulnerabilities"
+  kind: blog
+  url: https://www.endorlabs.com/learn/how-ai-sast-traced-data-flows-to-uncover-six-openclaw-vulnerabilities
+  date: 2026-02-18
+- title: "AI SAST Finding: Path Traversal in OpenClaw via LLM Guardrail Bypass"
+  kind: blog
+  url: https://www.endorlabs.com/learn/ai-sast-finding-path-traversal-in-openclaw-via-llm-guardrail-bypass
+  date: 2026-02-19