OpenClaw Gateway tool allowed unrestricted gatewayUrl override
OpenClaw's Gateway tool in versions up to 2026.2.13 accepted user-supplied gatewayUrl parameters without validation, potentially allowing attackers to redirect outbound WebSocket connections to unintended targets for network probing. The vulnerability was patched in version 2026.2.14 with URL validation and allowlisting.
What happened
The Gateway tool in OpenClaw versions 2026.2.13 and earlier accepted tool-supplied gatewayUrl parameters without sufficient validation, allowing users to override the destination for outbound WebSocket connections.
Some tool call paths allowed gatewayUrl overrides to flow into the Gateway WebSocket client without validation or allowlisting, enabling the OpenClaw host to be instructed to attempt connections to non-gateway endpoints such as localhost services, private network addresses, or cloud metadata IPs.
Reported impact
In typical cases, this resulted in outbound connection attempts from the OpenClaw host with corresponding errors or timeouts.
In environments where the tool caller could observe results, the vulnerability could be used for limited network reachability probing, and if the target spoke WebSocket and was reachable, further interaction might be possible.
Index analysis
The vulnerability was a Server-Side Request Forgery (SSRF) issue classified as CWE-918, allowing attackers with the ability to invoke tools accepting gatewayUrl overrides to manipulate outbound connection targets.
Governance controls
OpenClaw patched the vulnerability in version 2026.2.14 by restricting tool-supplied gatewayUrl overrides to loopback addresses on the configured gateway port or the configured gateway.remote.url, and rejecting disallowed protocols, credentials, query/hash parameters, and non-root paths.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.