CVE-2026-17458

Name of the Vulnerable Software and Affected Versions openclaw-cn versions prior to 0.2.2

Description An issue exists in the Browser Control HTTP API component within the clickViaPlaywright() function located in the src/browser/routes/agent.act.ts file. A remote attacker can perform a manipulation that leads to server-side request forgery (SSRF), a condition where the server is coerced into making unauthorized requests to an arbitrary destination.

Recommendations As a temporary workaround, restrict access to the clickViaPlaywright() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.