OpenClaw Windows Node EUVD-2026-90256

Requires the attacker to already hold gateway or agent access to the OpenClaw Windows Node (PR:L) and to invoke the canvas.present capability, which - unlike canvas.navigate - does not run the URL risk evaluation, so it accepts localhost/private/link-local/CGNAT/Tailscale(100.64/10)/cloud-metadata destinations. Exploitation is limited to deployments running OpenClaw Windows Node at or below 2026.9.4 with a reachable gateway/agent control channel (including a prompt-injected but legitimately connected agent); it does not work against anonymous external attackers and returns only limited data (VC:L/VI:L, no availability impact). DNS-rebinding to a private address is a residual the synchronous fix does not fully cover per the vendor's own note.

This is a genuine but bounded issue, not a high-severity emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, 5.3 Medium) shows the key limiter is PR:L: the attacker must already have gateway or agent access to the OpenClaw node, meaning exploitation presupposes a foothold in the agent control plane (or a prompt-injected agent) rather than an anonymous internet attacker. Impact is capped at VC:L/VI:L with no availability impact - consistent with a WebView-driven SSRF that can reach internal services but returns limited data to the attacker. EPSS, KEV, and POC signals are all ABSENT: no CISA KEV listing, no published exploit code, and no EPSS probability supplied, so there is no evidence of active or automated exploitation - status is 'no public exploit identified at time of analysis.' Signals are internally consistent (network-reachable capability, low privilege ceiling for the capability holder, low technical impact); the main real-world discriminator is whether the node's gateway/agent surface is exposed or reachable by an adversary. Treat as a defense-in-depth SSRF fix rather than a drop-everything priority.

An attacker who has compromised the OpenClaw gateway/agent channel - or who controls a prompt-injected agent driving the node - issues a canvas.present command instead of canvas.navigate, because canvas.present skips the URL risk evaluation. The node's WebView then fetches attacker-chosen internal URLs (e.g. http://127.0.0.1:port, 169.254.169.254 metadata, or tailnet/private-LAN services) from the victim's machine, letting the attacker probe or interact with services otherwise unreachable. No public exploit code is known, and the low attack complexity means a capable agent-side attacker could trigger it reliably.