OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untr…

Published:

5 mei 2026 om 22:00:00

Alert date:

6 mei 2026 om 23:05:11

Source:

nvd.nist.gov

Web Technologies

OpenClaw versions before 2026.4.5 contain a server-side request forgery (SSRF) vulnerability in the CDP /json/version WebSocket endpoint. The vulnerability allows attackers to pivot to untrusted second-hop targets by exploiting improper validation of the webSocketDebuggerUrl response field. Attackers can redirect connections to arbitrary hosts and perform SSRF-style attacks. The vulnerability has been patched in version 2026.4.5 with proper validation implemented.

Technical details

Mitigation steps:

Affected products:

OpenClaw