OpenClaw SSRF in sandbox execution: what practitioners need to know

TL;DR: CVE-2026-62201 in OpenClaw let a caller with access to the experimental sandbox exec-server read responses from private, loopback, link-local and metadata destinations before version 2026.6.6, despite only HTTP and HTTPS being accepted, according to Safe Security. The case shows that sandboxed execution still needs destination policy, DNS pinning and redirect revalidation, not just scheme filtering.

Editorial analysis by NHI Mgmt Group, based on content published by Safe Security: “CVE-2026-62201 OpenClaw: Sandbox Exec-Server SSRF and Network Policy Bypass”.

By the numbers:

• Safe Security assigned CVE-2026-62201 a CVSS v3.1 score of 7.7 / 10, which it classified as High.

Key questions

Q: What breaks when an AI assistant can fetch caller-supplied URLs without destination checks?

A: The control that breaks is the assumption that a safe-looking URL is a safe destination.

Q: Why does sandboxed execution increase SSRF risk in AI platforms?

A: Sandboxed execution increases SSRF risk because the request is made from the sandbox’s network context, not the caller’s.

Q: What are the signs that a URL fetch broker is failing closed enough?

A: Look for requests that are rejected before any backend call, destination logs that show private and metadata ranges being blocked, and redirect chains that are revalidated rather than trusted automatically.

Practitioner guidance

• Audit every brokered fetch path Identify any service that accepts a caller-supplied URL and forwards it to a backend, sandbox or worker.
• Block internal and metadata destinations by default Deny loopback, private, link-local, reserved and metadata address ranges unless a specific workload requirement justifies them.
• Disable optional sandbox execution where it is not needed Turn off preview or experimental execution brokers by default, especially when they extend a local assistant into a network-reachability layer.

Bottom line: The article shows that SSRF in sandboxed AI execution is really a destination-governance failure, not just a URL parsing bug.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →