CVE-2026-17458
Received Received - Intake

Server-Side Request Forgery in mf-yang openclaw-cn

Publication date: 2026-07-26

Last updated on: 2026-07-26

Assigner: VulDB

Description
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-26
Last Modified
2026-07-26
Generated
2026-07-26
AI Q&A
2026-07-26
EPSS Evaluated
N/A
NVD
CVE-2026-17458
EUVD
EUVD-2026-49053

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mf-yang openclaw-cn to 0.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the openclaw-cn package (versions up to 0.2.1). It allows an authenticated attacker to bypass the browser's SSRF protection policy and access loopback or private network targets. The issue occurs because the browser-control HTTP API enforces SSRF checks for direct navigation but fails to re-validate the final URL after interaction-driven navigation, such as clicking a link via the API.

Detection Guidance

Check if your openclaw-cn version is 0.2.1 or earlier by running: npm list openclaw-cn or pnpm list openclaw-cn. Inspect network logs for POST /act requests to loopback or private IPs. Monitor for unauthorized access to localhost admin endpoints or internal dashboards.

Impact Analysis

An attacker could exploit this to access restricted internal services like localhost admin endpoints or private dashboards. This breaks the intended isolation provided by the SSRF policy, potentially exposing sensitive data or internal systems to unauthorized access. The impact is limited to the product's trusted-operator model but still undermines a key security control.

Compliance Impact

This vulnerability, a Server-Side Request Forgery (SSRF) in openclaw-cn, could potentially undermine compliance with data protection regulations like GDPR and HIPAA by allowing unauthorized access to internal or private network resources. If exploited, it may enable attackers to interact with restricted endpoints, such as localhost admin interfaces or private dashboards, which could expose sensitive data or systems. This violates principles of least privilege and network isolation required by these standards.

Mitigation Strategies

Upgrade openclaw-cn to a version beyond 0.2.1 immediately. Disable the browser-control HTTP API if not required. Restrict network access to the application using firewalls to block outbound connections to private IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart