| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path.
A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline.
extensions/fal/image-generation-provider.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit 80d1e8a11a (fal: guard image fetches).
OpenClaw thanks @AntAISecurityLab for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free