EUVD-2026-78078
GHSA-f8g8-8f29-j2hw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring user interaction with low confidentiality impact only; no privilege escalation, scope change, or integrity/availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
AnalysisAI
Server-side request forgery in netease-youdao LobsterAI affects the buildBrowserConfig function within the Browser Network Configuration component, enabling remote attackers to manipulate the application into making forged outbound network requests to attacker-specified targets. Versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4 are confirmed affected per EUVD enumeration and NVD CPE wildcard coverage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires passive user interaction (UI:P in CVSS 4.0) to trigger the `buildBrowserConfig` function within the Browser Network Configuration component of LobsterAI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.1 - driven by UI:P (passive user interaction required) and VC:L (limited confidentiality impact only, no integrity or availability impact) - places this firmly in the informational tier despite network reachability (AV:N/AC:L/PR:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the originating GitHub issue (https://github.com/netease-youdao/LobsterAI/issues/2181) was closed automatically due to inactivity with no upstream fix committed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today