CVSS 4.0
2.3 lowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:NCVE-2026-45000
Low (2.3) in openclaw openclaw. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in openclaw 2026.4.20.
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed during normal profile status operations.
Severity
CVSS 3.1
5.0 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j4c5-89f5-f3pm | npm | openclaw | <2026.4.20 | 2026.4.20 |
References
- https://github.com/openclaw/openclaw/commit/1fd049e3074cac72f6734a7fe88468c84f5f8bd7
- https://github.com/openclaw/openclaw/commit/e90c89cf8b1459f2aa1f3a665be67392b6c03fdf
- https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c5-89f5-f3pm
- https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-browser-cdp-profile-creation