https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:26:45 +0000 https://cve.radiocsirt.org/vuln/cve-2026-53812 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.</p> https://cve.radiocsirt.org/vuln/cve-2026-53812 https://cve.radiocsirt.org/vuln/ghsa-2hfg-4fh4-qp7f <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>OpenClaw&#39;s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.</p> <p>This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.</p> <p>### Affected configurations</p> <p>This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.</p> <p>### Impact</p> <p>If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.</p> <p>The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>OpenClaw&#39;s browser control SSRF checks blocked direct navigation to private or loopback URLs, but some Playwright `act` interactions could trigger navigation after the initial check. A later browser evaluation could then read from the page reached by that action-triggered navigation.</p> <p>This issue is specific to browser control actions and private-network navigation policy. Browser evaluation remains an intentional trusted-operator feature when it is used on pages that policy allowed the browser to visit.</p> <p>### Affected configurations</p> <p>This affects deployments where browser control is enabled and an authenticated browser-control caller can interact with an attacker-controlled page that redirects or navigates the tab to a private-network target through a UI action.</p> <p>### Impact</p> <p>If the browser reached a private page through an unchecked action-triggered navigation, a caller with browser evaluation capability could read page content that direct navigation policy would have blocked.</p> <p>The issue does not grant access to OpenClaw without authentication. It bypasses the private-network navigation guard for a specific browser action path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict browser-control access to trusted operators and avoid using browser control on untrusted pages in environments with sensitive private web services.</p> https://cve.radiocsirt.org/vuln/ghsa-2hfg-4fh4-qp7f