EUVD-2026-49052
GHSA-wx37-g239-qv72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to openclaw-cn with low privileges
-
ExploitSend a crafted URL to the scheme handler
-
ExecutionTrigger the vulnerable assertBrowserNavigationAllowed bypass
-
ImpactLeak sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires low-privilege authenticated access to the openclaw-cn application and the ability to provide a crafted URL to the scheme handler. No specific configuration changes or non-default settings are needed beyond standard operation of the scheme handler. |
| Impact | The CVSS 4.0 base score is 2.1 (Low), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and only low confidentiality impact (no integrity or availability impact). No active exploitation or CISA KEV entry exists, though a proof-of-concept is publicly available (E:P). EPSS data is absent. Real-world risk is minimal given the low impact and the small deployment footprint of the niche application. The vulnerability does not pose an immediate priority. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to openclaw-cn crafts a malicious URL and sends it to the scheme handler. The vulnerable navigation guard fails to properly restrict navigation, causing the application to return sensitive information (e.g., internal paths, tokens) to the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.
RemediationAI
No vendor patch has been released; the project maintainer has not responded to the disclosure. Until a fix is available, restrict network access to the application or disable the affected scheme handler if feasible, though this may break related functionality. Monitor the GitHub repository and the VulDB advisory for updates. The public exploit proof-of-concept should be reviewed to understand the risk in your environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the assertBrowserNavigationAllowed function within src/browser/navigation-guard.ts, part of the application's Scheme Handler component. This function is responsible for validating URLs before navigation. Due to improper input handling (CWE-200) when processing a manipulated URL, the function may expose confidential information to unauthorized actors. The affected product, openclaw-cn, is an open-source desktop application (CPE: cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*), and the flaw is present in its Electron-based navigation guard.
Know when Openclaw Cn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Low-privilege remote attacker can trigger information disclosure without user interaction; confidentiality impact limited to low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Openclaw Cn
View allSymlink escape in openclaw-cn's apply_patch Tool allows authenticated remote attackers on versions up to 0.2.1 to traver
Server-side request forgery in openclaw-cn up to version 0.2.1 via the Browser Control HTTP API enables authenticated re
Privilege escalation in openclaw-cn (all versions up to 0.2.1) allows a remote attacker with low-level authentication to
Incorrect authorization in openclaw-cn 2026.2.5 allows authenticated remote attackers to bypass the Gateway Exec Approva
Exploit-DB