GHSA-j4c5-89f5-f3pm: Server-Side Request Forgery via CDP Profile Configuration in OpenClaw

Vulnerability ID: GHSA-J4C5-89F5-F3PM

CVSS Score: Not Assigned

Published: 2026-04-25

OpenClaw versions prior to 2026.4.18 are vulnerable to a Server-Side Request Forgery (SSRF) flaw due to improper state merging. The application automatically extracted hostnames defined in Chrome DevTools Protocol (CDP) profile configurations and incorrectly appended them to the global SSRF navigation allowlist. This behavior allowed attackers or malicious configurations to authorize automated browser navigation to restricted internal networks and cloud metadata services.

TL;DR

A flaw in OpenClaw's configuration parsing merged backend CDP hostnames into the frontend browser navigation allowlist, enabling SSRF bypasses against restricted internal networks.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-918

Attack Vector : Network

Impact : SSRF/Bypass

Severity : Low

Exploit Status : Proof-of-Concept

KEV Status : Not…