A server-side request forgery vulnerability in the OpenClaw Tlon Urbit extension allows unauthenticated attackers to force the application to perform unauthorized requests to arbitrary internal or external hosts.

This is a server-side request forgery (CWE-918) vulnerability located in the Tlon Urbit extension. The flaw allows an unauthenticated attacker to manipulate the authentication base URL, enabling the gateway to send HTTP requests to unintended targets.

The ability to perform server-side request forgery poses a significant risk to internal infrastructure security. An attacker can leverage this flaw to probe internal network services, bypass firewall restrictions, or interact with sensitive internal APIs that are not exposed to the public internet. With a CVSS score of 8.3, this high-severity vulnerability warrants immediate attention to prevent potential lateral movement and unauthorized data exposure within the internal network.

Immediate Action: Update the OpenClaw software to version 2026.2.14 or later to apply the necessary input validation fixes.

Proactive Monitoring: Monitor egress traffic from the application server for unexpected connections to internal network segments or unauthorized external endpoints.

Compensating Controls: If immediate patching is not feasible, restrict the application server's network access to only necessary internal and external resources using egress filtering rules or a restrictive proxy configuration.

Public Exploit Available: Unknown

Given the potential for internal network reconnaissance and the high CVSS severity, organizations should prioritize updating the OpenClaw package to the latest version. Please verify that the Tlon Urbit extension is updated as part of the broader application maintenance process to fully remediate the risk of request forgery.