EUVD-2026-45115
GHSA-fc43-vcvc-5qg7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF with low-privilege access required (PR:L); scope change (S:C) because confidentiality impact lands on internal subsequent systems, not OpenClaw itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked.
AnalysisAI
Server-side request forgery in OpenClaw's browser snapshot routes allows lower-privileged authenticated users to bypass the platform's network policy controls and reach internal destinations that should be blocked. Affected versions span 2026.4.14 through 2026.5.25; the fix shipped in 2026.5.26 per the vendor's GitHub security advisory. No public exploit code has been identified and this CVE is not listed in CISA KEV, though the CVSS 4.0 subsequent-system confidentiality rating of High reflects the real potential for lateral access to sensitive internal services.
Technical ContextAI
OpenClaw is a browser automation and snapshot service (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) that drives a server-side headless browser to load URLs and capture their state. CWE-918 (Server-Side Request Forgery) manifests here because the snapshot route instructs the server-side browser to navigate to a user-supplied URL but fails to re-validate the final landed destination after navigation completes. The term 'post-navigation destinations' indicates that initial policy checks occur at request time, but subsequent redirects - HTTP 3xx responses, JavaScript-driven redirects, or meta-refresh - can carry the browser to a different endpoint that is never re-evaluated against OpenClaw's policy engine. This allows the server-side browser to fetch and expose content from internal network resources the policy was explicitly designed to block.
RemediationAI
Upgrade OpenClaw to version 2026.5.26 or later, which introduces post-navigation destination validation against the platform's policy engine. The vendor's advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2x93-h3hg-2xfp should be consulted for specific upgrade steps. If an immediate upgrade is not possible, restrict access to the browser snapshot routes to only highly-trusted service accounts or administrators, removing the lower-trust attacker population that can trigger this flow - note that this may disrupt legitimate use cases if lower-trust users rely on snapshot functionality. As a layered compensating control, enforce egress filtering at the network or proxy layer independently of OpenClaw's application-level policy engine, ensuring that the server process itself cannot reach blocked internal destinations regardless of SSRF. This duplicates policy at the infrastructure layer and adds operational overhead but provides a defense-in-depth backstop while the patch is applied.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today