PT-2026-35794 · Openclaw · Openclaw

Ccreater + 2 · Published 2026-04-09 · Updated 2026-04-30 · CVE-2026-41912

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8

Description A server-side request forgery (SSRF) policy bypass allows attackers to trigger navigations that circumvent standard SSRF checks. By exploiting browser interactions, attackers can bypass these protections to access restricted resources. SSRF is a flaw where an attacker can force a server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

Recommendations Update to version 2026.4.8.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41912

GHSA-VR5G-MMX7-H897

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vr5g-mmx7-h897 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vr5g-mmx7-h897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41912 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-server-side-request-forgery-policy-bypass-via-interaction-triggered-navigation · Note
• https://t.me/cveNotify/161628 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049321936853885297 · Twitter Post
• https://twitter.com/CVEnew/status/2049227509120577622 · Twitter Post