The Gateway tool in OpenClaw accepted a supplied gatewayUrl without adequate filtering, allowing a tool caller to direct the host to initiate WebSocket connections to arbitrary endpoints. The vulnerability is an instance of outbound network connection discovery (CWE‑918) and can be used for limited reachability probing or, if the target speaks WebSocket, for further interaction with the host. This is not a drive‑by issue; it requires that an attacker be able to invoke a tool that accepts a gatewayUrl override, which in typical deployments is restricted to authenticated operators, trusted automation, or environments that expose tool calls to non‑operators.

OpenClaw products prior to version 2026.2.14 are affected. Versions 2026.2.14 and later contain a fix that restricts gatewayUrl overrides to loopback or the configured gateway.remote.url and rejects disallowed protocols or non‑root paths.

The vulnerability has a CVSS score of 7.6 and an EPSS score of less than 1%, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to trigger a tool call that accepts a gatewayUrl override, so the real‑world risk is limited to deployments that expose such calls to untrusted users. In environments where the attacker can observe responses, the vulnerability can be leveraged for network reconnaissance or, on reachable WebSocket targets, for additional malicious interaction.