EUVD-2026-36318
GHSA-2hfg-4fh4-qp7f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF requiring low-privilege auth; scope changes to subsequent private-network systems with full confidentiality impact; no integrity or availability impact described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.
AnalysisAI
Server-side request forgery in OpenClaw's Playwright-backed browser control allows authenticated low-privilege users to circumvent private-network navigation guards by chaining action-triggered redirects through the Playwright act interaction mechanism. All OpenClaw versions prior to 2026.5.18 are affected, and subsequent browser evaluation APIs can be abused to read the content of private-network pages - including internal services, admin panels, or cloud metadata endpoints reachable from the server. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the subsequent-system confidentiality impact is rated High in the CVSS 4.0 vector, reflecting meaningful data-disclosure potential in cloud-hosted or internally networked deployments.
Technical ContextAI
OpenClaw integrates Playwright - a headless browser automation framework - as part of its browser control feature. The vulnerability, rooted in CWE-918 (Server-Side Request Forgery), arises because the application's private-network navigation guard can be bypassed specifically via Playwright's 'act' interaction mechanism rather than through direct navigation calls. By triggering a browser action that causes an indirect redirect, an attacker can steer the Playwright browser to an RFC-1918 address or internal hostname that the guard would ordinarily reject. Once navigation succeeds, OpenClaw's browser evaluation capabilities - likely JavaScript execution within the browser context - allow the attacker to read and exfiltrate the content of the private page. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering all versions before 2026.5.18.
RemediationAI
Upgrade OpenClaw to version 2026.5.18 or later per the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2hfg-4fh4-qp7f; this is the only confirmed fix. If immediate patching is not feasible, restrict access to the browser control feature exclusively to highly trusted administrator accounts, since PR:L means any low-privilege user can exploit the bypass - tightening access reduces the attacker pool significantly but does not eliminate the flaw. As a network-layer compensating control, configure egress filtering on the OpenClaw server host to block outbound connections to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata service addresses (169.254.169.254, fd00:ec2::254, 100.64.0.0/10); note that aggressive egress filtering may break legitimate browser control use cases requiring access to intranet resources and should be tested before production deployment. Disabling the browser control feature entirely, if not required, eliminates the attack surface at the cost of losing that functionality.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today