CVE-2026-62201 shows how sandbox SSRF exposes internal services

At a glance

What this is: This is an analysis of CVE-2026-62201 in OpenClaw, where sandbox exec-server requests could reach internal and metadata destinations because destination policy was missing.

Why it matters: It matters because AI and automation platforms that broker network calls on behalf of assistants can turn a local capability into an internal data exposure path if destination controls are weak.

By the numbers:

• Safe Security assigned CVE-2026-62201 a CVSS v3.1 score of 7.7 / 10, which it classified as High.

Context

Server-side request forgery happens when a trusted component fetches a URL supplied by a caller and then returns the result. In this case, the issue sits inside a local-first AI assistant platform, which makes the governance question sharper because a low-friction execution feature can cross a trust boundary without looking like a traditional web proxy.

The vulnerable path was an experimental sandbox exec-server that accepted a caller-controlled URL and forwarded it into a sandbox backend. That makes destination control the real security boundary, not the fact that the request used HTTP or HTTPS. In identity terms, the question is whether the runtime path is allowed to act as an intermediary identity at all.

Key questions

Q: What breaks when an AI assistant can fetch caller-supplied URLs without destination checks?

A: The control that breaks is the assumption that a safe-looking URL is a safe destination. Without destination checks, a brokered fetch path can reach loopback, private or metadata services and return their responses to a less-trusted caller. That turns an execution helper into an internal network oracle and can expose service inventory, headers or sensitive response data.

Q: Why does sandboxed execution increase SSRF risk in AI platforms?

A: Sandboxed execution increases SSRF risk because the request is made from the sandbox’s network context, not the caller’s. That means the platform may inherit reachability to internal applications, management interfaces or metadata services that the original caller should never see. The risk is highest when the broker returns response content directly to the requester.

Q: What are the signs that a URL fetch broker is failing closed enough?

A: Look for requests that are rejected before any backend call, destination logs that show private and metadata ranges being blocked, and redirect chains that are revalidated rather than trusted automatically. If the application only validates scheme or hostname format, the control is still too weak. Effective controls stop unsafe destinations at resolution time.

Q: How should teams govern delegated access for AI coding agents in platform tools?

A: Treat the agent as a scoped operational actor, not as a generic automation layer. Define read, scaffold, and write permissions separately, review which resource classes it can touch, and ensure its authority stops at the smallest set of Konnect objects needed for the task.

Technical breakdown

How the sandbox exec-server crossed a trust boundary

OpenClaw’s exec-server sat between a caller and a sandbox backend, translating JSON-RPC requests into outbound HTTP fetches from the sandbox network context. That architecture is useful for delegated execution, but it also means the broker becomes a policy enforcement point. If the broker accepts a URL and only checks syntax or scheme, it is not making an authorisation decision about the destination. The result is classic SSRF behaviour: the system becomes a network oracle and a fetch proxy for whichever addresses the sandbox can reach. See the SSRF Prevention Guide.

Practical implication: Treat every brokered request path as an authorisation decision, not just a parsing problem.

Why scheme filtering does not stop internal destination abuse

Checking that a URL begins with HTTP or HTTPS blocks obvious abuse like file or gopher schemes, but it does not say anything about where the resolved connection will land. A hostname can resolve to loopback, private, link-local or metadata space, and a literal IP can do the same. Redirects add another escape path if the destination is not revalidated after the first hop. In short, protocol allowlisting is necessary but not sufficient when the real risk is network reachability into privileged zones.

Practical implication: Validate the resolved destination, not just the URL string, before any request leaves the control plane.

Why sandboxed AI tooling needs destination policy and DNS pinning

The fix described in the article combines pre-flight destination checks, execution-side address classification, DNS resolution inside the environment that actually makes the request, and redirect revalidation. That combination matters because a request can be safe at parse time and unsafe after resolution or redirection. Disabling inherited proxy handling also reduces the chance that environmental routing bypasses the intended policy. For AI tools and other delegated execution systems, the control must follow the request all the way to the network stack.

Practical implication: Enforce egress policy at the point of resolution and again at redirect handling, not only at request intake.

Threat narrative

Attacker objective: The objective is to use a trusted execution broker to read responses from internal or metadata services that the original caller should not be able to reach.

1. Entry occurs when a caller reaches the experimental sandbox exec-server and submits a crafted http/request call with a target URL.
2. Credential_harvested is not the right label here, because the article’s abuse path is destination reachability rather than stolen credentials.
3. Escalation happens when the broker forwards the request into the sandbox network context without checking whether the resolved destination is private, loopback, link-local or metadata space.
4. Impact is the return of status, headers and body content from internal services back to the caller, creating a confidentiality leak.

Breaches seen in the wild

• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.
• JADEPUFFER agentic ransomware 2026: The first documented agentic ransomware used harvested keys, default MinIO credentials and a default Nacos signing key to wipe a database.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Destination policy, not scheme filtering, is the real control boundary in brokered AI execution. The article shows that allowing only HTTP and HTTPS did not prevent access to loopback, private and metadata destinations. That matters because delegated execution systems often confuse protocol validation with trust validation. Practitioners should treat any runtime that fetches caller-supplied URLs as a network policy decision point, not a utility function.

Sandboxed execution creates an identity problem as much as a network problem. The sandbox exec-server acted like a delegated runtime identity with reach beyond the caller’s own network position. When an assistant platform can act on behalf of a user or workflow, the question becomes which destinations that delegated identity may contact. That intersection belongs in agentic AI security policy and in the access model for the execution broker.

SSRF in AI tooling is increasingly a governance failure around outbound trust. The article’s core weakness was not exotic payload handling but missing destination governance for a local capability. That pattern is broader than one product: any platform that brokers tool use, model actions or sandbox calls can become a reachability amplifier if outbound policy is implicit rather than explicit. Practitioners should assume the trust boundary is the request destination, not the calling interface.

Network origin is a weak proxy for authorisation in local-first systems. The tested sandbox could reach services that the original caller could not, which means the runtime inherited a stronger network identity than the user or session that initiated it. That is a governance gap wherever local assistants, workload sandboxes or internal brokers mediate traffic. Teams should align execution rights, network rights and data exposure rights instead of treating them as the same control plane.

What this signals

Outbound trust has become a first-class control in AI execution systems. Traditional network segmentation is not enough when a tool broker can initiate requests on behalf of a caller. The practical control is to define which destinations a delegated runtime may contact, and to enforce that rule at resolution time, redirect time and execution time.

Agentic and sandboxed systems need explicit network identity boundaries. A local assistant that can reach internal services behaves differently from the user who launched it. That means governance has to distinguish the human identity, the runtime identity and the destination identity, especially where tool use can cross from convenience into confidential data exposure.

For practitioners

• Audit every brokered fetch path Identify any service that accepts a caller-supplied URL and forwards it to a backend, sandbox or worker. Confirm whether the system checks destination policy after DNS resolution, after redirects and before socket connect.
• Block internal and metadata destinations by default Deny loopback, private, link-local, reserved and metadata address ranges unless a specific workload requirement justifies them. Apply the rule in both the control plane and the execution environment so bypasses cannot occur through resolution changes.
• Disable optional sandbox execution where it is not needed Turn off preview or experimental execution brokers by default, especially when they extend a local assistant into a network-reachability layer. Keep the feature limited to trusted local runtimes and do not bridge it to less-trusted callers.
• Test redirect and resolution edge cases Replay the same URL through literal IPs, hostnames that resolve to private space, and redirect chains that cross trust zones. Verify that the service rejects the request before the backend issues any outbound connection.

Key takeaways

• The article shows that SSRF in sandboxed AI execution is really a destination-governance failure, not just a URL parsing bug.
• The vulnerable path allowed responses from internal, loopback, link-local and metadata targets to be returned through a delegated execution broker.
• Effective containment depends on destination validation, DNS-aware policy enforcement and strict egress limits around sandboxed runtimes.

Related NHI Mgmt Group resources: Agentic AI Security Policy Template · SSRF Prevention Guide · Vulnerability Management Guide

Key terms

• Server-Side Request Forgery: An attack pattern where a vulnerable server is tricked into making requests on the attacker’s behalf. In application exploitation, SSRF can be used to reach internal resources, fetch malicious payloads, or amplify a flaw into full code execution.
• Destination Policy: Destination policy is the rule set that decides which network targets a brokered request may contact. In delegated execution systems, it must account for resolved IP ranges, redirects, proxy behaviour and special-use addresses, not just the visible URL string.
• Sandbox-exec: A macOS command-line wrapper that applies a sandbox profile to a process at launch. It can reduce what the process is allowed to do, but it does not create a new security boundary if the profile is permissive or the underlying OS path can be re-routed.
• SSL Pinning: SSL pinning is a certificate validation control that makes an app trust only a known certificate or public key when it connects to a server. This limits man-in-the-middle interception, even if an attacker installs a rogue certificate authority on the device. It strengthens transport security, but it is not bypass-proof.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity controls to the broader execution and access decisions that shape risk.