GHSA-pg2v-8xwh-qhcc: OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication

February 18, 2026

The optional Tlon (Urbit) extension previously accepted a user-provided base URL for authentication and used it to construct an outbound HTTP request, enabling server-side request forgery (SSRF) in affected deployments.

References

github.com/advisories/GHSA-pg2v-8xwh-qhcc
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/bfa7d21e997baa8e3437657d59b1e296815cc1b1
github.com/openclaw/openclaw/releases/tag/v2026.2.14
github.com/openclaw/openclaw/security/advisories/GHSA-pg2v-8xwh-qhcc

Code Behaviors & Features

Detect and mitigate GHSA-pg2v-8xwh-qhcc with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →