https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:16:47 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45000 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed during normal profile status operations.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed during normal profile status operations.</p> https://vulnerability.circl.lu/vuln/cve-2026-45000 https://vulnerability.circl.lu/vuln/ghsa-j4c5-89f5-f3pm <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt; 2026.4.20` - Patched version: `2026.4.20`</p> <p>## Impact</p> <p>Browser profile creation normalized `cdpUrl` values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.</p> <p>Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.</p> <p>## Fix</p> <p>OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.</p> <p>Fix commits:</p> <p>- `1fd049e3074cac72f6734a7fe88468c84f5f8bd7` - `e90c89cf8b1459f2aa1f3a665be67392b6c03fdf`</p> <p>## Release</p> <p>Fixed in OpenClaw `2026.4.20`.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt; 2026.4.20` - Patched version: `2026.4.20`</p> <p>## Impact</p> <p>Browser profile creation normalized `cdpUrl` values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.</p> <p>Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.</p> <p>## Fix</p> <p>OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.</p> <p>Fix commits:</p> <p>- `1fd049e3074cac72f6734a7fe88468c84f5f8bd7` - `e90c89cf8b1459f2aa1f3a665be67392b6c03fdf`</p> <p>## Release</p> <p>Fixed in OpenClaw `2026.4.20`.</p> https://vulnerability.circl.lu/vuln/ghsa-j4c5-89f5-f3pm