OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate… (CVE-2026-62227)

OpenClaw versions 2026.4.14 before 2026.5.26 have a server-side request forgery vulnerability (CWE-918) in the browser snapshot routes. The vulnerability occurs due to insufficient validation of post-navigation destinations, enabling attackers with limited privileges to bypass OpenClaw's policy enforcement and access restricted network destinations. This could allow unauthorized internal network access or interaction with otherwise blocked resources. No public exploit code or active exploitation has been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, and requires privileges but no user interaction, with a scope change and medium severity.

Attackers with lower-trust access can exploit this SSRF vulnerability to bypass policy checks and reach network destinations that should be blocked by OpenClaw. This could lead to unauthorized access to internal network resources or services that are otherwise inaccessible. There is no evidence of active exploitation in the wild at this time.

A fixed version of OpenClaw is available starting from 2026.5.26. Users should upgrade to this version or later to remediate the vulnerability. Since the vulnerability is due to improper validation of post-navigation destinations, applying the official fix is the recommended mitigation. No vendor advisory or patch links were provided, so users should consult the vendor for the official patch and further guidance.