EUVD-2026-45114
GHSA-7g8c-r2vm-433h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF with low-privilege requirement; scope change to subsequent systems with high confidentiality impact; no availability impact on either the vulnerable or subsequent system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.
AnalysisAI
Authorization bypass in OpenClaw (versions 2026.3.28 through before 2026.5.19) allows low-privileged network attackers to exploit the browser act route's failure to validate current-tab URLs, enabling Server-Side Request Forgery (SSRF) that crosses authorization boundaries into restricted resources. The CVSS 4.0 scope-change metrics (SC:H/SI:L with VC:N/VI:N/VA:N) reveal that the primary impact falls on subsequent systems rather than OpenClaw itself - meaning attackers can reach internal resources or perform policy-restricted actions using their laundered, lower-trust credentials. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis.
Technical ContextAI
OpenClaw's browser act route is responsible for processing browser-driven actions, and its current-tab URL validation logic is the root cause of this flaw (CWE-918: Server-Side Request Forgery). When the route fails to properly enforce URL allowlists or current-tab origin checks, a lower-trust caller can craft requests the application forwards on their behalf to targets they should not access - the vulnerable service acts as an inadvertent proxy, laundering lower-privilege credentials into higher-privilege actions or reaching systems behind authorization tiers. CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* identifies the OpenClaw application as the affected component across its version range. The CVSS 4.0 AT:P (attack requirements: present) metric confirms that exploitation depends on specific environmental conditions, such as configured input paths or the presence of lower-trust roles with access to the act route.
RemediationAI
Upgrade to OpenClaw 2026.5.19 or later, which resolves the authorization bypass in the browser act route per the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-x863-pqjw-hmgf. Where immediate patching is not feasible, restrict network-layer access to the browser act route so only the highest-trust user tier can invoke it - this removes the lower-privilege escalation path but may degrade legitimate browser automation workflows. Additionally, audit and harden configured input paths to eliminate lower-trust entries; removing attacker-influenceable paths reduces the SSRF surface even if the authorization bypass remains. Blocking outbound connections from the OpenClaw server to sensitive internal endpoints (metadata services, internal APIs, privileged back-end systems) via egress ACLs limits blast radius of any successful SSRF exploitation without disrupting core functionality. Each workaround carries operational risk: route-level ACLs may break legitimate lower-trust workflows, and overly broad egress blocking may disrupt integration features.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today