The vulnerability CVE-2026-90818 affects netease-youdao LobsterAI versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4. It resides in the OpenClawConfigSync.buildBrowserConfig function of the src/main/libs/openclawConfigSync.ts file, part of the Browser Network Configuration component. The flaw enables server-side request forgery (SSRF), allowing an attacker to induce the server to make arbitrary requests. The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code is available, but there is no indication of active exploitation in the wild. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, partial user interaction, low confidentiality impact, and no integrity or availability impact.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server, potentially accessing internal resources or services not otherwise exposed. However, the impact is rated medium with low confidentiality impact and no integrity or availability impact according to the CVSS 4.0 vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and consider implementing network-level restrictions to limit server outbound requests as a temporary mitigation.