Openclaw cli: OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable (CVE-2026-42430)

CVE-2026-42430 describes a vulnerability in OpenClaw CLI's use of Playwright where strict browser SSRF protections can be bypassed during request-time navigation redirects. This allows user-controlled local assistant OpenClaw to reach private network targets that should be protected by SSRF restrictions. The vulnerability is scoped to the OpenClaw trust model and does not assume multi-tenant service boundaries. The issue was fixed in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 and released in OpenClaw version 2026.4.8.

An attacker controlling OpenClaw can bypass strict SSRF protections in Playwright redirect handling to reach private network targets. This could lead to unauthorized access or information disclosure within private networks. The CVSS score is 6.5 (medium severity) with high confidentiality impact, low integrity impact, and no availability impact. The vulnerability requires low privileges and user interaction and involves a complex attack vector.

A patch is available and should be applied by upgrading OpenClaw to version 2026.4.8 or later. The fix has been verified with regression tests. No additional mitigation steps are indicated by the vendor advisory.