Listen to this Post
The vulnerability (no official CVE ID, but tracked as openclaw SSRF bypass) works as follows:
OpenClaw allows browser profile creation with a `cdpUrl` (Chrome DevTools Protocol endpoint).
During profile creation, the `cdpUrl` string is normalized (e.g., trimmed, default port added) before being persisted in storage.
However, the normalization step does not invoke the configured browser SSRF (Server-Side Request Forgery) policy check.
In deployments that explicitly disable private-network CDP targets (strict-mode), the policy should reject any `cdpUrl` pointing to RFC 1918 addresses, link-local, or cloud metadata endpoints.
Because the policy is not applied at creation time, an operator with profile creation privileges can store a malicious `cdpUrl` such as `http://169.254.169.254/latest/meta-data/`.
Later, normal profile status flows (e.g., health checks, automatic reconnection) will probe the stored `cdpUrl` without re-evaluating the SSRF policy.
This probe originates from the OpenClaw service, effectively performing an SSRF request to the internal endpoint.
The default “trusted-operator” browser behavior allows private-network CDP endpoints, so the bypass only manifests when the administrator has explicitly disabled private targets via the browser SSRF policy.
No authentication bypass or privilege escalation occurs; the attacker must already have profile creation rights.
The root cause is the missing policy hook in the profile persistence logic, while the reachability checker (used later) does enforce the policy.
The fix adds an explicit SSRF policy check during both profile creation and any reachability operation, ensuring that invalid `cdpUrl` values are rejected immediately.
Thus, a stored profile cannot later become a blind SSRF vector in strict-mode environments.
dailycve form:
Platform: npm openclaw
Version: <2026.4.20
Vulnerability: SSRF policy bypass
Severity: low
date: 2026-04-25
Prediction: Already patched
What Undercode Say:
Check installed openclaw version
npm list openclaw
Verify if vulnerable (versions below 2026.4.20)
npm view openclaw versions --json | grep "2026.4.20"
Simulate the vulnerable profile creation (requires API access)
curl -X POST http://localhost:3000/profiles \
-H "Content-Type: application/json" \
-d '{"name":"test","cdpUrl":"http://169.254.169.254/latest/meta-data/"}'
After fix, same command should be rejected with SSRF policy violation
Monitor for internal probes in strict-mode logs
grep "SSRF policy blocked" /var/log/openclaw/audit.log
how Exploit:
- Gain operator-level access to openclaw profile creation endpoint.
- Create a profile with `cdpUrl` pointing to a private IP (e.g., 192.168.1.1:9222) or metadata service.
- Wait for profile status check (automatic or triggered) – openclaw probes the stored URL.
- The probe leaks response data (e.g., cloud metadata) or scans internal network.
Protection from this CVE
- Upgrade to openclaw 2026.4.20 or later.
- If upgrade impossible, enforce strict SSRF policy and manually audit existing profiles for suspicious `cdpUrl` values.
- Restrict profile creation privileges to only highly trusted operators.
- Monitor outbound requests from openclaw to unexpected private IP ranges.
Impact:
Low severity. Only impacts strict-mode deployments where private-network CDP targets are explicitly disabled. Default “trusted-operator” setups are unaffected. Attacker needs existing profile creation privileges. Outcome is limited SSRF to internal endpoints (metadata, internal services) but not remote code execution or data exfiltration beyond what the openclaw service can access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
