Is there a patch available for EUVD-2026-33336?

Yes, a patch is available for EUVD-2026-33336. Update the affected software to the latest version immediately.

OpenClaw EUVD-2026-33336

Q: What is the CVSS score of EUVD-2026-33336?

EUVD-2026-33336 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35673 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-29 disclosure@vulncheck.com

GHSA-7339-549c-w53j

SSRF Authentication Bypass Openclaw

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

May 29, 2026 - 17:02 EUVD

Analysis Generated

May 29, 2026 - 16:52 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.29.

DescriptionCVE.org

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers with access to these routes can bypass private-network SSRF policies by reusing blocked tabs to export or inspect content that should remain protected.

AnalysisAI

SSRF policy bypass in OpenClaw before 2026.4.29 enables authenticated low-privileged attackers to circumvent private-network SSRF protections via browser debug and export routes. The flaw (CWE-863, Incorrect Authorization) allows an attacker who already holds valid credentials to reuse previously blocked browser tabs, causing the application to export or inspect content from protected internal resources that the SSRF policy was intended to restrict. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis, though the high confidentiality impact on the vulnerable component (VC:H in CVSS 4.0) warrants prompt patching for internet-exposed instances.

Technical ContextAI

OpenClaw is an open-source project whose browser debug and export features maintain state about open and blocked tabs. The root cause is CWE-863 (Incorrect Authorization): the authorization logic governing SSRF policy enforcement does not re-evaluate a tab's blocked status when that tab is subsequently reused in debug or export route operations. Once a tab has been opened and its outbound request blocked by the SSRF policy, later reuse of that tab object bypasses the policy check entirely, because the enforcement gate runs only at initial tab creation, not on reuse. No CPE data was provided in the available intelligence; affected scope is scoped to the vulnerable component (SC:L in CVSS 4.0), suggesting limited lateral impact to subsequent components. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P) reflects that network access is required, conditions must be specifically arranged (AT:P), and low-level authentication plus passive user interaction are prerequisites.

RemediationAI

Upgrade OpenClaw to version 2026.4.29 or later; this is the vendor-indicated fix boundary per the CVE description and the GitHub Security Advisory GHSA-hcm3-8f6r-6xwg. Consult the advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-hcm3-8f6r-6xwg and the VulnCheck write-up at https://www.vulncheck.com/advisories/openclaw-ssrf-policy-bypass-via-browser-debug-export-routes for additional patch confirmation. If immediate upgrade is not feasible, restrict access to the browser debug and export routes via network-layer controls (e.g., firewall rules, reverse-proxy ACLs) so that only explicitly trusted, highly privileged users can reach these endpoints - this raises the effective privilege bar above the PR:L level the CVSS vector reflects. Additionally, disabling browser debug features in production environments is a viable compensating control if the feature is not operationally required; note this may impact debugging workflows. Do not rely on SSRF policy configuration alone as a control while the vulnerable version remains deployed, since the bypass directly targets that policy.