EUVD-2026-26132Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with high complexity and low privilege reflects the proxy-env-dependent redirect bypass; scope change and high confidentiality capture SSRF reach into private internal systems.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks. Attackers can exploit request-time navigation to reach private targets that should be restricted by browser SSRF protections.
AnalysisAI
Server-side request forgery bypass in OpenClaw (npm) before 2026.4.8 allows authenticated users to reach private internal network targets by exploiting a race condition in Playwright redirect handling. Strict SSRF checks implemented via DNS pinning can be circumvented when request-time navigation occurs during a redirect, allowing traversal to otherwise-blocked private addresses. The GHSA advisory explicitly scopes this to OpenClaw's user-controlled local assistant trust model, not a multi-tenant service boundary. No public exploit code exists and SSVC indicates exploitation status as none at time of analysis.
Technical ContextAI
OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is a Node.js-based local AI assistant distributed via npm. It uses Microsoft Playwright for browser automation and implements a custom fetchWithSsrFGuard layer (src/infra/net/fetch-guard.ts) that enforces SSRF protections through DNS pinning - resolving and pinning hostnames before requests are dispatched to prevent mid-flight redirect attacks. CWE-918 (Server-Side Request Forgery) describes the root cause: insufficient validation of user-supplied URLs before server-side fetch operations. The specific flaw is that in the TRUSTED_ENV_PROXY code path, DNS pinning (resolvePinnedHostnameWithPolicy) was conditionally skipped when proxy environment variables were active, leaving a window where Playwright's request-time navigation during a redirect could reach private IP space before the guard re-evaluated the resolved address.
RemediationAI
Upgrade the openclaw npm package to version 2026.4.8 or later, which contains the verified fix at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5). The fix restores DNS pinning (resolvePinnedHostnameWithPolicy) within the TRUSTED_ENV_PROXY code path so that pinning is skipped only when a proxy environment variable is actually configured, not unconditionally. If immediate upgrade is not possible, a compensating control is to unset or clear proxy environment variables (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and their lowercase variants) from the OpenClaw runtime environment, which prevents the vulnerable TRUSTED_ENV_PROXY branch from being activated; this may break legitimate proxy routing and should be evaluated against the deployment environment. Additionally, restricting network egress from the host running OpenClaw to known-good external addresses via firewall rules reduces the impact of any successful SSRF bypass.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today