OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can b…

Published:

4 mei 2026 om 22:00:00

Alert date:

5 mei 2026 om 20:13:49

Source:

nvd.nist.gov

Web Technologies

OpenClaw versions before 2026.4.10 contain a server-side request forgery (SSRF) policy bypass vulnerability in browser tabs action routes. The vulnerability affects the select and close routes in the browser tabs functionality. Attackers can exploit the /tabs/action endpoint to bypass configured browser SSRF policy protections. This allows unauthorized tab navigation operations to be performed. The vulnerability has been assigned CVE-2026-42439 and is currently undergoing analysis.

Technical details

Mitigation steps:

Affected products:

OpenClaw