NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
MEDIUM severity

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivotsGHSA-2858-xg23-26fp

MEDIUMFix: openclaw/openclaw@3bf19d6

GHSA-2858-xg23-26fp is a medium-severity (CVSS 5.5) vulnerability in openclaw. A fix is available for openclaw — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Mar 4, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

132other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
openclawnpm
3.4Mdownloads / week

Description

Summary

OpenClaw accepted camera.snap / camera.clip node payload url fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host.

In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: >= 2026.2.13 <= 2026.3.1
  • Latest vulnerable published version at time of update: 2026.3.1
  • Patched versions: >= 2026.3.2 (released)

Technical Details

Vulnerable flows accepted URL payloads and downloaded directly from the provided URL:

  • src/cli/nodes-camera.ts (writeUrlToFile) fetched URL payloads without node-host binding.
  • src/cli/nodes-cli/register.camera.ts passed camera.snap / camera.clip payload URLs into that downloader.
  • src/agents/tools/nodes-tool.ts did the same for camera_snap / camera_clip tool actions.

Impact

A malicious/compromised paired node could cause gateway-host URL fetches to off-node destinations reachable from the host network. This could be used for internal network probing/fetch pivots in deployments where paired nodes are not fully trusted.

Remediation

The fix introduces fail-closed node-host binding and guarded fetch for camera URL payload downloads:

  • Require resolved node host metadata for URL payload downloads.
  • Enforce hostname match between payload URL and resolved node host.
  • Use SSRF-guarded fetch with redirect host/protocol checks.
  • Apply the same enforcement across CLI and agent tool camera paths.

Fix Commit(s)

  • 3bf19d6f40a0aaa55818b96eede3d05130c02533

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmopenclaw≥ 2026.2.13&&< 2026.3.22026.3.2npm install openclaw@2026.3.2

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openclaw, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update openclaw to 2026.3.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2858-xg23-26fp is resolved across your whole dependency graph.

  3. Workarounds

    Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

### Summary OpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host. In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `>= 2026.2.13 <= 2026.3.1` - Latest vulnerable published version at time of update:
O3 Security · Impact-Aware SCA

Is GHSA-2858-xg23-26fp in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
OpenClaw: Node camera URL payload host-binding…