PT-2026-37326 · Npm · Openclaw

Published 2026-04-25 · Updated 2026-04-25

OSV

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: < 2026.4.20
• Patched version: 2026.4.20

Impact

Browser profile creation normalized cdpUrl values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.

Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.

Fix

OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.

Fix commits:

• 1fd049e3074cac72f6734a7fe88468c84f5f8bd7
• e90c89cf8b1459f2aa1f3a665be67392b6c03fdf

Release

Fixed in OpenClaw 2026.4.20.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

GHSA-J4C5-89F5-F3PM

Affected Products

Openclaw

References · 5

• https://osv.dev/vulnerability/GHSA-j4c5-89f5-f3pm · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/e90c89cf8b1459f2aa1f3a665be67392b6c03fdf · Note
• https://github.com/openclaw/openclaw/commit/1fd049e3074cac72f6734a7fe88468c84f5f8bd7 · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c5-89f5-f3pm · Note