CVE-2026-90818

Name of the Vulnerable Software and Affected Versions netease-youdao LobsterAI versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4

Description A flaw in the Browser Network Configuration component allows for remote server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue resides in the OpenClawConfigSync.buildBrowserConfig() function within the src/main/libs/openclawConfigSync.ts file.

Recommendations For netease-youdao LobsterAI versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4, restrict the use of the OpenClawConfigSync.buildBrowserConfig() function as a temporary mitigation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.