CVE-2026-45000

5.0 Moyenne

Publiée le 11/05/2026 à 20:16 · Modifiée le 17/06/2026 à 12:51 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed during normal profile status operations.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	2.3 Faible	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.0 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/openclaw/openclaw/commit/1fd049e3074cac72f6734a7fe88468c84f5f8bd7 Patch
https://github.com/openclaw/openclaw/commit/e90c89cf8b1459f2aa1f3a665be67392b6c03fdf Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c5-89f5-f3pm Third Party Advisory
https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-browser-cdp-profile-creation PatchThird Party Advisory

CVE-2026-45000

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs