CVE-2026-17457
Received Received - Intake

Information Disclosure in mf-yang OpenClaw via Scheme Handler

Publication date: 2026-07-26

Last updated on: 2026-07-26

Assigner: VulDB

Description
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-26
Last Modified
2026-07-26
Generated
2026-07-26
AI Q&A
2026-07-26
EPSS Evaluated
N/A
NVD
CVE-2026-17457
EUVD
EUVD-2026-49052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mf-yang openclaw-cn to 0.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authenticated local file disclosure issue in the openclaw-cn browser control API. It allows an attacker to bypass navigation restrictions and open arbitrary file:// URLs, enabling the reading of local file contents through the snapshot endpoint. The flaw occurs because the navigation guard only validates http: and https: URLs, allowing unsupported schemes like file: to reach the Chrome/CDP navigation sink.

Detection Guidance

Check if openclaw-cn versions 0.2.1 or earlier are installed by running: npm list openclaw-cn or pnpm list openclaw-cn. Inspect network traffic for POST requests to /tabs/open with file:// URLs. Monitor for unauthorized access to /snapshot endpoints returning local file contents.

Impact Analysis

An attacker can exploit this by sending a POST request to /tabs/open with a file:// URL, receiving a valid target ID, and then retrieving file contents via the /snapshot endpoint. This exposes sensitive local files such as HTML reports or debugging artifacts. The impact is limited to authenticated users within the trusted-operator model.

Compliance Impact

This vulnerability allows authenticated attackers to read local files via file:// URLs, potentially exposing sensitive data such as HTML reports or debugging artifacts. For GDPR, this could lead to unauthorized access to personal data, violating principles of data minimization and security. Under HIPAA, exposure of local files containing protected health information would constitute a breach, requiring notification and potential penalties.

Mitigation Strategies

Upgrade openclaw-cn to a patched version if available. Restrict access to authenticated users only. Block file:// URL navigation in the browser control API. Monitor for suspicious POST requests to /tabs/open and /snapshot endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17457. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart