Most recent entries from all

BREW-openclaw-cli-CVE-2026-42439 — OpenClaw: Browser tabs action select and close routes bypassed SSRF policy

Affected: Homebrew: openclaw-cli

## Summary

Browser tabs action select and close routes bypassed SSRF policy.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.

## Technical Details

The fix enforces browser SSRF policy in the select and close tab-action branches.

## Fix

The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `48c0347921b7e9438af0312968fc360ca88023f3` - PR: #63332

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.

EUVD-2026-308562

fkie_cve-2026-42439

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

GHSA-rj2p-j66c-mgqh — OpenClaw: Browser tabs action select and close routes bypassed SSRF policy

Affected: npm: openclaw