OpenClaw versions prior to 2026.4.14 had a browser SSRF policy that allowed private-network navigation by default. This behavior could expose internal services or metadata endpoints through browser-driven requests where stricter SSRF protections were expected. The issue was fixed in version 2026.4.14 by enforcing strict SSRF configuration semantics and disabling private-network access unless explicitly enabled.