https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:14:16 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-53812 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>OpenClaw&#39;s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.</p> <p>This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.</p> <p>### Affected configurations</p> <p>This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.</p> <p>### Impact</p> <p>If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.</p> <p>The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>OpenClaw&#39;s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.</p> <p>This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.</p> <p>### Affected configurations</p> <p>This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.</p> <p>### Impact</p> <p>If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.</p> <p>The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-53812 https://cve.radiocsirt.org/vuln/euvd-2026-329564 EUVD-2026-329564 https://cve.radiocsirt.org/vuln/euvd-2026-329564 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53812 <p>OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.</p> <p>OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53812 https://cve.radiocsirt.org/vuln/ghsa-2hfg-4fh4-qp7f <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>OpenClaw&#39;s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.</p> <p>This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.</p> <p>### Affected configurations</p> <p>This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.</p> <p>### Impact</p> <p>If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.</p> <p>The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>OpenClaw&#39;s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.</p> <p>This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.</p> <p>### Affected configurations</p> <p>This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.</p> <p>### Impact</p> <p>If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.</p> <p>The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.</p> https://cve.radiocsirt.org/vuln/ghsa-2hfg-4fh4-qp7f https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1738 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsmechanismen zu umgehen, erhöhte Berechtigungen zu erlangen, Informationen offenzulegen, Konfigurationen zu manipulieren, beliebige Befehle oder Code auszuführen sowie interne Systeme über SSRF anzugreifen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsmechanismen zu umgehen, erhöhte Berechtigungen zu erlangen, Informationen offenzulegen, Konfigurationen zu manipulieren, beliebige Befehle oder Code auszuführen sowie interne Systeme über SSRF anzugreifen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1738