{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/openclaw--2026.4.14--2026.5.26/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-62227"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenClaw (\u003e= 2026.4.14, \u003c 2026.5.26)"],"_cs_severities":["high"],"_cs_tags":["ssrf","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["OpenClaw"],"content_html":"\u003cp\u003eA significant server-side request forgery (SSRF) vulnerability, identified as CVE-2026-62227, has been discovered in OpenClaw versions 2026.4.14 through 2026.5.25. This flaw resides within the browser snapshot routes where the application fails to properly validate post-navigation destinations. Attackers who have already obtained lower-trust access to an OpenClaw instance can exploit this vulnerability to bypass internal network policy checks. By crafting specific requests, they can force the OpenClaw server to initiate connections to arbitrary internal or restricted network destinations that would normally be blocked, effectively using the server as a proxy to access otherwise unreachable resources. The exploitation of this vulnerability could lead to unauthorized information disclosure, reconnaissance of internal networks, or even further attacks on internal services.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker obtains \u0026quot;lower-trust access\u0026quot; to a vulnerable OpenClaw instance, potentially via a compromised user account or another initial access vector.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a vulnerable browser snapshot route within the OpenClaw application.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting this snapshot route, embedding an internal or restricted network URL (e.g., \u003ccode\u003ehttp://127.0.0.1/admin\u003c/code\u003e or \u003ccode\u003ehttp://10.0.0.1/internal-api\u003c/code\u003e) as the post-navigation destination.\u003c/li\u003e\n\u003cli\u003eThe OpenClaw server processes this crafted request. Due to the SSRF vulnerability (CVE-2026-62227), it fails to properly validate the embedded internal destination.\u003c/li\u003e\n\u003cli\u003eOpenClaw's server-side component then initiates an HTTP request from its own context to the attacker-specified internal destination.\u003c/li\u003e\n\u003cli\u003eThe OpenClaw server acts as an unwitting proxy, retrieving the content or executing the request against the internal network resource.\u003c/li\u003e\n\u003cli\u003eThe attacker receives the response from the internal resource via the OpenClaw server, thereby bypassing network segmentation and security policies.\u003c/li\u003e\n\u003cli\u003eThe attacker can use the gained access or information for further reconnaissance, lateral movement, or data exfiltration from the internal network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful exploitation of CVE-2026-62227 allows attackers to gain unauthorized access to internal network resources and services that should typically be inaccessible from the OpenClaw instance. This can lead to sensitive information disclosure, exposure of internal APIs, or mapping of the internal network topology. Such access could serve as a stepping stone for further sophisticated attacks, including lateral movement, exploitation of other internal vulnerabilities, or exfiltration of proprietary data, ultimately compromising the confidentiality, integrity, and availability of internal systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-62227 immediately by upgrading OpenClaw to version 2026.5.26 or later to address the SSRF vulnerability.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to your SIEM to detect attempts to exploit SSRF by identifying suspicious patterns in webserver logs.\u003c/li\u003e\n\u003cli\u003eEnsure comprehensive webserver logging is enabled for all OpenClaw instances, capturing full HTTP request details, including method, URI stem, and query parameters.\u003c/li\u003e\n\u003cli\u003eImplement robust network segmentation and egress filtering to limit the OpenClaw server's ability to initiate connections to internal network segments or sensitive services, even if an SSRF vulnerability is exploited.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-17T02:33:02Z","date_published":"2026-07-17T02:33:02Z","id":"https://feed.craftedsignal.io/briefs/2026-07-openclaw-ssrf/","summary":"A server-side request forgery (SSRF) vulnerability, CVE-2026-62227, in OpenClaw versions before 2026.5.26 allows attackers with lower-trust access to bypass network policy checks through browser snapshot routes, leading to unauthorized access to internal network destinations.","title":"OpenClaw SSRF Vulnerability (CVE-2026-62227) Allows Network Policy Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-openclaw-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenClaw (\u003e= 2026.4.14, \u003c 2026.5.26)","version":"https://jsonfeed.org/version/1.1"}