Server-Side Request Forgery Vulnerability in OpenClaw Windows Node by OpenClaw

CVE-2026-101883

What is CVE-2026-101883?

The OpenClaw Windows Node through version 2026.9.4 is susceptible to a server-side request forgery (SSRF) vulnerability within the canvas.present feature. This vulnerability allows attackers with gateway or agent access to bypass URL risk evaluation mechanisms enforced by the canvas.navigate function. Consequently, this enables unauthorized requests to be sent to localhost, private networks, or tailnet services from the affected user's machine. It poses significant risks to the security of local resources, demanding immediate attention from users to mitigate potential exploitation.

References