Executive brief
OpenClaw is an AI automation platform that includes browser control capabilities allowing authenticated users to interact with web pages. The vulnerability allows authenticated users to bypass security checks that normally prevent navigation to private internal networks (like 127.0.0.1 or local services). By tricking the browser into navigating to a private target through a UI action on an attacker-controlled page, an authenticated user with browser evaluation permissions can then read sensitive data from internal services that should be protected, potentially exposing private network information or services.
Technical details
This is a server-side request forgery (SSRF) vulnerability in OpenClaw's browser control feature. The root cause is that the SSRF protection checks for direct navigation to private/loopback addresses (CWE-918), but fail to enforce the same checks on Playwright browser action interactions that can trigger secondary navigation. An authenticated user with browser-control access can interact with an attacker-controlled webpage that performs a redirect or navigation through a UI action (e.g., clicking a link, form submission) to a private-network target. Since the action-triggered navigation bypasses the initial policy check, a subsequent browser evaluation can read the content of the reached private page, exposing data that the access control policy intended to protect. Attack requires: (1) authentication to OpenClaw, (2) browser control enabled, (3) ability to interact with attacker-controlled pages. The vulnerability does not grant unauthenticated access. Patched in version 2026.5.18.
Affected products
- OpenClaw openclaw < 2026.5.18
Timeline
- 2026-07-02: disclosed: GHSA-2hfg-4fh4-qp7f published
- 2026-05-18: patched: Version 2026.5.18 released with patch