PT-2026-37008 · Openclaw · Openclaw
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.4.14
Description
Improper access control in browser snapshot, screenshot, and tab routes allows authenticated callers to bypass Server-Side Request Forgery (SSRF) restrictions. This occurs because the system fails to consistently validate the final browser target after route-driven navigation, potentially exposing content from internal or disallowed pages.
Recommendations
Update to version 2026.4.14 or newer.
Exploit
Fix
Missing Authorization
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw