Is there a public PoC exploit available for CVE-2026-17457?

Yes, a public proof-of-concept exploit is available for CVE-2026-17457. Prioritise patching immediately. EPSS: 0.3%.

openclaw-cn CVE-2026-17457

Q: What is the CVSS score of CVE-2026-17457?

CVE-2026-17457 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-49052 LOW

Information Exposure (CWE-200)

2026-07-26 VulDB

GHSA-wx37-g239-qv72

Information Disclosure Openclaw Cn Mf Yang

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Low-privilege remote attacker can trigger information disclosure without user interaction; confidentiality impact limited to low.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 12:05 vuln.today

Severity Changed

Jul 26, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

Jul 26, 2026 - 10:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Jul 26, 2026 - 09:30 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Information disclosure in mf-yang openclaw-cn up to version 0.2.1 allows remote authenticated attackers with low privileges to leak sensitive data by supplying a crafted URL to the scheme handler. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The vulnerability resides in the assertBrowserNavigationAllowed function within src/browser/navigation-guard.ts, part of the application's Scheme Handler component. This function is responsible for validating URLs before navigation. Due to improper input handling (CWE-200) when processing a manipulated URL, the function may expose confidential information to unauthorized actors. The affected product, openclaw-cn, is an open-source desktop application (CPE: cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*), and the flaw is present in its Electron-based navigation guard.

RemediationAI

No vendor patch has been released; the project maintainer has not responded to the disclosure. Until a fix is available, restrict network access to the application or disable the affected scheme handler if feasible, though this may break related functionality. Monitor the GitHub repository and the VulDB advisory for updates. The public exploit proof-of-concept should be reviewed to understand the risk in your environment.