EUVD-2026-26118Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default proxy env configuration required (AC:H), low-privilege auth (PR:L), user interaction trigger (UI:R), with scope change granting access to internal resources (S:C/C:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access restricted resources.
AnalysisAI
SSRF policy bypass in OpenClaw (npm) versions before 2026.4.8 allows low-privilege authenticated users to exploit browser interaction-triggered navigations that circumvent the application's DNS-pinning SSRF guards. The bypass is specific to the TRUSTED_ENV_PROXY execution mode, activated when proxy environment variables are present, causing the fetch guard to skip hostname resolution policy enforcement and permitting requests to restricted internal resources. No active exploitation is confirmed by CISA KEV; EPSS is 0.03% (7th percentile) and SSVC exploitation status is none, though the subsequent-system confidentiality impact is rated high.
Technical ContextAI
OpenClaw is a local AI assistant distributed as an npm package (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-918 (SSRF) and resides in src/infra/net/fetch-guard.ts within the fetchWithSsrFGuard function. When proxy environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, or their lowercase equivalents) are set, the code activated a TRUSTED_ENV_PROXY mode that completely skipped the call to resolvePinnedHostnameWithPolicy - the DNS-pinning enforcement step that validates outbound destinations against the SSRF policy. Browser-triggered navigation events could then route requests to internal or otherwise-blocked hostnames without policy scrutiny. The commit diff (d7c3210cd6f5fdfdc1beff4c9541673e814354d5) confirms the fix: DNS pinning is now applied conditionally, skipping only when a proxy is actually configured, so the SSRF policy remains enforced in all modes.
RemediationAI
Upgrade the OpenClaw npm package to version 2026.4.8 or later; this is the vendor-confirmed patched version per GHSA-vr5g-mmx7-h897. The verified fix is at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5), which includes regression tests for the affected security boundary. As a compensating control prior to upgrading, unset or avoid configuring HTTP_PROXY, HTTPS_PROXY, HTTPS_PROXY, ALL_PROXY, http_proxy, https_proxy, and all_proxy environment variables in the OpenClaw process environment; this prevents the TRUSTED_ENV_PROXY mode from activating and eliminates the bypass path, though it may disrupt outbound connectivity through enterprise proxies and should be evaluated for operational impact before applying.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today