EUVD-2026-28172Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.
AnalysisAI
OpenClaw before version 2026.4.10 allows authenticated attackers to bypass Server-Side Request Forgery (SSRF) policy enforcement through incomplete navigation guard coverage in browser press and type interactions. Attackers can trigger unauthorized navigation actions, including pressKey and type-submit flows, that skip post-action security checks, potentially enabling SSRF attacks against restricted endpoints.
Technical ContextAI
OpenClaw is a browser automation and testing framework that implements SSRF guards to prevent unauthorized navigation to restricted network resources. The vulnerability exists in the browser interaction layer (pw-tools-core.interactions.js and related modules) where pressKey and type submission interactions were not subject to the same three-phase navigation guard checks applied to other interaction types like click. The root cause is an incomplete authorization check (CWE-862) where certain interaction handlers failed to invoke assertPageNavigationCompletedSafely with the current SSRF policy before allowing navigation. The fix (commits 049acf23, 5f5b3d73, e0b8ddc1) retrofits these missing interactions with the same post-action security validation applied to click-triggered navigations, ensuring all browser interaction routes enforce SSRF policy constraints.
RemediationAI
Upgrade OpenClaw to version 2026.4.10 or later immediately. The npm registry contains patched versions 2026.4.10 through 2026.4.14, all of which include fixes from commits 049acf23cb03e1b92f5c71cd99c6ec5f35cc56fe, 5f5b3d733bdd791cb457f838514179e1288b10b3, and e0b8ddc1a55185aff1cf9e0e095014d2e4f1d894 (addressing PRs #62023, #63226, #63889). For environments unable to upgrade immediately, implement explicit SSRF policy validation in wrapper code around press and type interactions by ensuring ssrfPolicy parameters are always provided and post-action page URL validation is enforced via external security middleware. Review OpenClaw deployment contexts to identify what private network resources are accessible; if SSRF is not a threat model (e.g., OpenClaw runs in isolated environments with no access to internal APIs), the practical risk is reduced. Reference vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-536q-mj95-h29h and https://www.vulncheck.com/advisories/openclaw-incomplete-navigation-guard-coverage-in-browser-interactions for confirmation of fix compatibility.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today