CVE-2026-100576
Received Received - Intake

Server-Side Request Forgery in OpenClaw Browser Wait Predicates

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or private destinations without navigation checks applied to other browser actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100576
EUVD
EUVD-2026-87475

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in OpenClaw versions before 2026.8.1. It allows attackers to bypass SSRF protections by using the wait --fn function against an existing browser session to access loopback or private destinations without proper navigation checks.

Detection Guidance

Detecting this vulnerability requires checking OpenClaw versions before 2026.8.1. Use the command 'openclaw --version' or inspect version files in OpenClaw installation directories. Monitor network traffic for unexpected requests to loopback or private addresses originating from OpenClaw processes.

Impact Analysis

An attacker could exploit this to bypass SSRF policies if they control a browser-enabled agent with an active session. The impact depends on which services are reachable and the browser's state, potentially allowing access to internal or restricted systems.

Compliance Impact

This SSRF vulnerability could allow unauthorized access to internal or loopback services, potentially exposing sensitive data or systems. For GDPR, this may lead to unauthorized data processing or breaches if personal data is accessed. For HIPAA, it could enable unauthorized access to protected health information if internal systems are compromised.

Mitigation Strategies

Immediately upgrade OpenClaw to version 2026.8.1 or later. If upgrading is not possible, disable browser predicate evaluation for sessions exposed to lower-trust content. Restrict network access to OpenClaw processes to prevent unauthorized requests to loopback or private addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart