internet-facing-service-vulnerabilitywidely-deployed-product-advisory

OpenClaw SSRF Flaws Expose Internal Services Through Citation Redirects and Image Fetches

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 23, 2026

OpenClaw disclosed two high-severity server-side request forgery vulnerabilities affecting versions prior to 2026.3.1 and 2026.3.28. CVE-2026-32902 impacts web_search citation redirect resolution, where attacker-influenced redirect targets can cause the OpenClaw gateway host to send requests to private-network destinations. The issue is tracked as CWE-918 and was assigned a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L, indicating remote exploitation without privileges or user interaction.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Mar 23, 2026 – Mar 31, 2026

Mar 31, 20267mo ago
CVE-2026-34504 disclosed for OpenClaw fal provider SSRF
CVE-2026-34504 was disclosed for a server-side request forgery vulnerability affecting OpenClaw versions before 2026.3.28. On the disclosure date, VulnCheck records show the CVE was first received with an initial CVSS score and then updated the same day to a higher-impact CVSS vector with changed scope.
Mar 28, 20267mo ago
OpenClaw fixes fal provider SSRF in version 2026.3.28
An OpenClaw code change referenced by the disclosure addressed an SSRF issue in the fal provider's image download handling, affecting versions before 2026.3.28. The flaw could allow a malicious or compromised fal relay to fetch internal URLs and expose internal service metadata through the image pipeline.
Mar 23, 20268mo ago
CVE-2026-32902 recorded for OpenClaw citation redirect SSRF
A new CVE, CVE-2026-32902, was recorded for a server-side request forgery vulnerability affecting OpenClaw versions before 2026.3.1. The flaw in web_search citation redirect resolution could let attackers induce the OpenClaw gateway host to send requests to private-network destinations.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

SSRF in OpenClaw web_search citation redirect resolution (CVE-2026-32902)SSRF in OpenClaw fal provider image-generation-provider.ts (CVE-2026-34504)

Affected products

1 linked

Openclaw

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Mar 31, 2026

CVE-2026-34504 - OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal ProviderOpen source ↗

Cvefeed High SeverityAdvisories · Mar 23, 2026

CVE-2026-32902 - OpenClaw < 2026.3.1 - Server-Side Request Forgery via Citation Redirect ResolutionOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

OpenClaw SSRF Flaws Expose Internal Services Through Citation Redirects and Image Fetches

How this story unfolded

CVE-2026-34504 disclosed for OpenClaw fal provider SSRF

OpenClaw fixes fal provider SSRF in version 2026.3.28

CVE-2026-32902 recorded for OpenClaw citation redirect SSRF

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

OpenClaw Flaws Allowed Authentication Bypass and Admin Privilege Escalation

OpenClaw Flaws Let Authenticated Users Escalate Privileges and Bypass Authorization

OpenClaw Vulnerability Enables Token Exfiltration and One-Click RCE via Malicious Link

OpenClaw SSRF Flaws Expose Internal Services Through Citation Redirects and Image Fetches

How this story unfolded

CVE-2026-34504 disclosed for OpenClaw fal provider SSRF

OpenClaw fixes fal provider SSRF in version 2026.3.28

CVE-2026-32902 recorded for OpenClaw citation redirect SSRF

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

OpenClaw Flaws Allowed Authentication Bypass and Admin Privilege Escalation

OpenClaw Flaws Let Authenticated Users Escalate Privileges and Bypass Authorization

OpenClaw Vulnerability Enables Token Exfiltration and One-Click RCE via Malicious Link