OpenClaw before version 2026.4.10 contains a server-side request forgery (SSRF) policy bypass vulnerability in the browser tabs action select and close routes. Attackers can exploit the /tabs/action endpoint to bypass configured browser SSRF policy protections and perform unauthorized tab navigation operations. This vulnerability allows attackers to circumvent security controls designed to prevent SSRF attacks. The issue affects the tab management functionality of the OpenClaw application. Users should upgrade to version 2026.4.10 or later to mitigate this vulnerability.