OpenClaw SSRF Policy Bypass Vulnerability (CVE-2026-41912)

OpenClaw versions prior to 2026.4.8 are susceptible to a server-side request forgery (SSRF) policy bypass vulnerability, identified as CVE-2026-41912. This flaw allows attackers to circumvent standard SSRF protections by manipulating browser interactions to trigger navigations. By exploiting this vulnerability, an attacker can potentially gain unauthorized access to internal resources and sensitive information that should otherwise be protected by SSRF mitigation measures. The vulnerability was reported on April 28, 2026, and poses a significant risk to organizations using affected versions of OpenClaw, as it can lead to the exposure of internal services and data.

Attack Chain

1. An attacker identifies an OpenClaw instance running a version prior to 2026.4.8.
2. The attacker crafts a malicious request designed to exploit the SSRF policy bypass.
3. The victim user, with access to the OpenClaw application, interacts with the attacker's crafted payload within their browser.
4. The malicious request triggers a navigation event within the browser, bypassing the intended SSRF protections.
5. OpenClaw, due to the policy bypass, processes the request without proper validation.
6. The application makes an unintended request to an internal resource based on the attacker-controlled navigation.
7. Sensitive information from the internal resource is accessed by the OpenClaw application.
8. The attacker retrieves the data, completing the SSRF attack.

Impact

Successful exploitation of CVE-2026-41912 can lead to the exposure of sensitive internal resources and data. An attacker could potentially access internal APIs, databases, or other services that are not intended to be exposed to the public internet. The impact depends on the nature of the resources exposed but could range from information disclosure to the compromise of internal systems.

Recommendation

• Upgrade OpenClaw to version 2026.4.8 or later to remediate the SSRF vulnerability (CVE-2026-41912).
• Deploy the provided Sigma rule to detect exploitation attempts by monitoring for suspicious navigation patterns indicative of SSRF bypass attempts.