EUVD-2026-45090
GHSA-3fh8-p25m-jh6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered SSRF by lower-trust caller (PR:L); scope changes to internal network systems (S:C); confidentiality High on reached systems, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies.
AnalysisAI
Network policy bypass via Server-Side Request Forgery (SSRF) in OpenClaw's sandbox exec-server allows lower-trust callers to route HTTP requests to internal network destinations that OpenClaw policy is explicitly configured to block. All OpenClaw installations before version 2026.6.6 are affected. The CVSS 4.0 vector scores subsequent-system confidentiality impact as High (SC:H), reflecting that successfully bypassed network policies expose internal infrastructure - not the OpenClaw host itself - to unauthorized access. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
OpenClaw's exec-server provides a sandboxed execution environment with network policy controls intended to restrict which internal network destinations callers of varying trust levels can reach. CWE-918 (Server-Side Request Forgery) describes the root cause: the exec-server acts as a network intermediary and fails to sufficiently validate or enforce policy checks on outbound HTTP requests initiated by lower-trust principals, allowing those requests to be forwarded to blocked internal endpoints. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, covering all versions prior to 2026.6.6. The CVSS 4.0 AT:P metric (Attack Requirements: Present) indicates that specific preconditions - specifically operating within the sandbox exec-server context as a lower-trust caller - must exist for exploitation.
RemediationAI
Upgrade to OpenClaw version 2026.6.6 or later, which is the vendor-released patch confirmed by the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-mgvr-6gvw-3rgr. If an immediate upgrade is not feasible, compensating controls should focus on restricting who can interact with the exec-server as a lower-trust caller - for example, tightening authentication requirements or ACLs on the exec-server endpoint to prevent untrusted principals from submitting requests. Additionally, deploying network-layer egress controls (firewall rules, service mesh policies) at the infrastructure level for the internal destinations that should be blocked provides defense-in-depth independent of OpenClaw's policy enforcement, though this does not remediate the underlying bypass and may not cover all intended policy destinations. Note that infrastructure-level rules add operational overhead and may conflict with legitimate exec-server workloads.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today