GHSA-56f2-hvwg-5743

Description: The image tool argument flows through createImageTool.execute() into loadWebMedia(), then loadWebMediaInternal(), then fetchRemoteMedia(), and reaches fetch(url) with no allowlist and no network restriction when sandboxRoot is unset. URL detection is a regex (/^https?:\/\//i) and nothing validates the destination between that test and the request.

The server-side fetch was confirmed through the error response: a MIME-type validation failure proves the fetch happened even though the payload was not an image. Affects openclaw before 2026.2.2.

Impact: Server-Side Request Forgery reaching internal services and cloud metadata endpoints from a single tool invocation.

Fixed in commits 81c68f5 and 9bd64c8, which route remote media through SSRF guards with private and internal IP blocking, hostname validation, redirect hardening, and DNS pinning. First of the batch to be patched, in 2026.2.2, ahead of the rest in 2026.2.14. No CVE was assigned.