EUVD-2026-29145
GHSA-5w5h-c32q-r6w9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed during normal profile status operations.
AnalysisAI
Server-side request forgery in OpenClaw before version 2026.4.20 allows authenticated attackers to bypass strict-mode SSRF policy checks during browser CDP profile creation by storing profiles pointing to private-network or metadata endpoints, which are later probed during normal profile status operations. The vulnerability affects only strict-mode deployments that explicitly restrict private-network CDP targets; default configurations allow private-network endpoints and are not vulnerable. Vendor-released patch: 2026.4.20.
Technical ContextAI
OpenClaw manages browser Chrome DevTools Protocol (CDP) profiles for remote browser control. The vulnerability exists in the CDP profile creation and reachability-check flows. The application normalized CDP endpoint URLs (cdpUrl) before persisting them but failed to validate these endpoints against the configured browser SSRF policy at creation time. In strict-mode deployments with disabled private-network access, an attacker could store a profile containing a private-network IP (e.g., 172.29.128.1) or metadata endpoint, and the endpoint would be probed later when profile status operations executed reachability checks. The root cause is improper enforcement of SSRF policy boundaries at the profile creation boundary (CWE-918: Server-Side Request Forgery). The fix applies SSRF policy validation during both profile creation and reachability operations, and creates a separate reachability policy that permits the selected CDP host without widening the browser's navigation SSRF policy.
RemediationAI
Upgrade OpenClaw to version 2026.4.20 or later; this is the vendor-released patch that applies SSRF policy validation during profile creation and reachability operations. The fix ensures that CDP endpoints are checked against the browser SSRF policy at creation time, preventing storage of profiles pointing to restricted private-network or metadata endpoints. For users unable to upgrade immediately, deploy strict-mode SSRF policies (disabling private-network CDP targets) and restrict who can create or modify browser profiles via access controls, since exploitation requires authenticated access. However, note that strict-mode policies alone do not prevent exploitation in unpatched versions; the vulnerability exists precisely because strict-mode checks were bypassed at profile creation time. Verify the upgrade by checking that commit 1fd049e3074cac72f6734a7fe88468c84f5f8bd7 or later is included in your build. Patch references: https://github.com/openclaw/openclaw/commit/1fd049e3074cac72f6734a7fe88468c84f5f8bd7 and https://github.com/openclaw/openclaw/commit/e90c89cf8b1459f2aa1f3a665be67392b6c03fdf.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today