Threats tagged 'ghsa-5w5h-c32q-r6w9'

OpenClaw versions prior to 2026.4.20 contain a server-side request forgery (SSRF) vulnerability in the browser CDP profile creation process. This flaw allows attackers to create stored profiles that bypass strict-mode SSRF policy checks, enabling requests to private network or metadata endpoints. These malicious profiles are later accessed during normal profile status operations, potentially allowing unauthorized internal network probing.