CVE-2026-28476

OpenClaw (npm) with the optional Tlon Urbit extension is affected by SSRF when a user-controllable base URL for authentication is not properly validated. The vulnerability enables an attacker who can influence the configured Urbit URL to trigger outbound HTTP requests to arbitrary hosts, includin...