CVE-2026-28476

Description: The channels.tlon.account.url configuration value flows from monitor/index.ts into authenticate(account.url, account.code), where it is interpolated into fetch(\\${url}/~/login`)with no validation of scheme, host, or destination. Anyone able to influence that configuration causes the extension to POST credentials (password=code) to an arbitrary internal or external service. Pointing it at169.254.169.254` produced a confirmed server-side request to the cloud metadata endpoint.

The trust boundary is the point worth noting: a configuration value is not user input in the traditional sense, but config files, environment variables, and admin interfaces are all reachable, and the value lands in a network sink unchecked. Affects openclaw before 2026.2.14.

Impact: Server-Side Request Forgery with credential disclosure to the attacker-chosen host.

Fixed in commit bfa7d21, which restricts the scheme to HTTPS, adds an SSRF guard blocking private and internal hosts, and gates private networks behind an opt-in channels.tlon.allowPrivateNetwork. The 6.3 recorded here is the CVSS v4.0 score published with the advisory; its v3.1 score is 8.3.