EUVD-2026-27265Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through browser-driven requests.
AnalysisAI
Server-side request forgery in OpenClaw npm package before 2026.4.14 allows authenticated remote attackers to access internal services and cloud metadata endpoints through browser-driven requests. The vulnerability stems from a misconfigured browser SSRF policy that permits private-network navigation by default, enabling cross-scope information disclosure without user interaction. Patch available in version 2026.4.14 with vendor advisory and multiple fix commits confirmed. No public exploit or CISA KEV listing identified at time of analysis, though CVSS 7.7 reflects high confidentiality impact with changed scope.
Technical ContextAI
This vulnerability affects the OpenClaw npm package (cpe:2.3:a:openclaw:openclaw), specifically its browser SSRF protection mechanism that controls network request behavior. The root cause is CWE-918 (Server-Side Request Forgery), where the default browser SSRF policy failed to properly restrict private-network navigation. In browser automation and headless browser contexts, SSRF policies govern which network ranges (public, private, loopback) can be accessed through automated requests. The misconfiguration allowed browser-driven requests to reach RFC1918 private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16), exposing cloud metadata endpoints (like AWS 169.254.169.254/latest/meta-data) and internal services that should be unreachable from application-layer code. The fix in version 2026.4.14 preserves strict SSRF configuration semantics, disables private-network access by default unless explicitly opted in, and updates loopback CDP (Chrome DevTools Protocol) readiness handling to prevent the stricter policy from blocking legitimate local control operations.
RemediationAI
Upgrade OpenClaw to version 2026.4.14 or newer immediately. This version contains the complete fix implemented via PR #66354 and #66386, with four specific commits (024f461, 1dabfef, 213c36c, 7eecfa4) that restore strict SSRF policy defaults while preserving necessary loopback CDP control functionality. Users on npm can update via standard package manager: npm update openclaw or yarn upgrade openclaw. For environments unable to upgrade immediately, implement network-level compensating controls: deploy egress filtering to block outbound requests to RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and loopback (127.0.0.0/8) from the application layer. In cloud environments, apply IMDSv2 (Instance Metadata Service version 2) enforcement on AWS or equivalent metadata endpoint protections on other platforms to require session tokens for metadata access, mitigating credential exfiltration even if SSRF succeeds. Note these workarounds add operational complexity and may break legitimate internal service communication - conduct thorough testing before production deployment. Vendor advisory with technical details: https://github.com/openclaw/openclaw/security/advisories/GHSA-53vx-pmqw-863c.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today