Threats tagged 'ghsa-2hfg-4fh4-qp7f'

OpenClaw CLI had a vulnerability where certain browser control interactions could bypass private-network navigation checks, allowing authenticated users with browser evaluation capabilities to read content from private or loopback URLs. This issue affected versions prior to 2026.5.18 and was fixed in that release. The vulnerability requires authenticated access and does not grant unauthorized access to OpenClaw itself. Mitigation involves upgrading to version 2026.5.18 or later and restricting browser control access to trusted operators before patching.