CVE-2026-26322

Description: The gatewayUrl tool argument from Gateway, Canvas, and Cron invocations flows through resolveGatewayOptions() into callGateway() and reaches new WebSocket(url) unvalidated. Three separate controls are missing: no protocol allowlist, no host validation, and no IP restriction on RFC1918, loopback, or cloud metadata ranges.

{ "tool": "gateway", "gatewayUrl": "ws://169.254.169.254" }
  -> resolveGatewayOptions(opts)
  -> gateway = { url: opts.gatewayUrl, ... }
  -> callGateway({ url: gateway.url })
  -> new WebSocket(url)     // no validation

Confirmed by invoking the Gateway tool against controlled test infrastructure and observing the outbound WebSocket connection. Affects openclaw before 2026.2.14.

Impact: Server-Side Request Forgery. Probes internal services, reaches cloud metadata endpoints, and bypasses network-level restrictions.

Fixed in commit c5406e1, which restricts Gateway URL overrides to loopback on the configured gateway port or the explicitly configured gateway.remote.url, and rejects disallowed protocols, embedded credentials, query strings, and non-root paths.