OpenClaw EUVD-2026-87475

Requires an attacker who can already drive the OpenClaw agent (PR:L - authenticated or steered caller) AND an existing/active browser session to target. Exploitation is specifically through the browser wait --fn predicate function, which is the exact feature that omits the navigation-time SSRF validation applied to other browser actions. Limiting factors: prior low-privilege access to the agent is mandatory, a browser session must already exist, and the affected version must be OpenClaw before 2026.8.1; it is not exploitable against unauthenticated external users or default configurations without agent access.

This is a genuinely low-severity SSRF, and for once the vendor's own scoring reflects that honestly. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, base 5.3) shows a network-reachable but privilege-gated (PR:L) flaw with only LOW confidentiality and integrity impact and no availability impact. The attacker must already have an authenticated/steered channel driving the agent AND an existing browser session, then abuse the wait --fn predicate to reach loopback/private destinations that the framework's navigation-time SSRF checks would otherwise block. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code in the provided data - exploitation status is 'no public exploit identified at time of analysis.' Contrast with the two sibling OpenClaw SSRFs (CVE-2026-100567 DNS-rebinding, CVE-2026-100574 trusted-host DNS recheck), which carry inflated VC:H scores; this one's LOW-impact rating is more defensible because a wait-predicate request primarily reaches an internal endpoint rather than reliably exfiltrating full response bodies. Real-world priority is LOW: it is a defense-in-depth bypass gated behind prior authenticated access to a niche open-source agent framework, not a widespread or automatable threat.

An attacker who already has authorized (but low-privilege/steered) control of an OpenClaw agent with a live browser session invokes the wait --fn predicate pointed at an internal address such as http://127.0.0.1 or a cloud metadata/private-range host. Because the wait predicate does not apply the SSRF navigation checks used elsewhere, the request reaches the blocked internal destination. No public proof-of-concept exploit is identified in the available data.