Server-Side Request Forgery Policy Bypass in OpenClaw
CVE-2026-41912

4.8MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
28 April 2026

What is CVE-2026-41912?

OpenClaw versions prior to 2026.4.8 are susceptible to a server-side request forgery (SSRF) policy bypass. This vulnerability enables an attacker to exploit browser interactions that circumvent standard SSRF checks, granting access to restricted resources. By leveraging this flaw, malicious actors can effectively manipulate navigation behavior to trigger unauthorized requests, posing significant security risks to applications relying on OpenClaw.

Affected Version(s)

OpenClaw 0 < 2026.4.8

OpenClaw 2026.4.8

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/d7c3210cd6f5f...
patch
https://www.vulncheck.com/advisories/openclaw-server-side...
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ccreater (@ccreater222)
KeenSecurityLab
qclawer
.