CVE-2026-53812
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
OpenClaw before version 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data in private networks, posing a serious security threat to the organization.
Recommendation
It is recommended to update OpenClaw to version 2026.5.18 or later to mitigate this vulnerability and review application security to minimize risk.
Original NVD description (English source)
OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.