CVE-2026-90818

Deferred Deferred - Pending Action

Server-Side Request Forgery in NetEase Youdao LobsterAI

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-03

NVD

CVE-2026-90818

Affected Vendors & Products

Vendor	Product	Version / Range
netease-youdao	lobsterai	2026.6.15
netease-youdao	lobsterai	2026.8.28
netease-youdao	lobsterai	2026.9.3
netease-youdao	lobsterai	2026.9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) flaw in netease-youdao LobsterAI versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4. It exists in the OpenClawConfigSync.buildBrowserConfig function within the src/main/libs/openclawConfigSync.ts file, specifically affecting browser network configuration. An attacker can manipulate this function to make unauthorized server-side requests.

Detection Guidance

This vulnerability involves server-side request forgery in netease-youdao LobsterAI. Detection requires inspecting network traffic for unusual outbound requests from the application, particularly those originating from the OpenClawConfigSync.buildBrowserConfig function. Check logs for unexpected external connections initiated by the application.

Impact Analysis

The SSRF vulnerability allows remote attackers to send crafted requests from the affected server. This could lead to unauthorized access to internal systems, data exfiltration, or further network reconnaissance. Since the exploit is public, the risk of real-world attacks is elevated.

Compliance Impact

The vulnerability is a server-side request forgery (SSRF) flaw in netease-youdao LobsterAI. SSRF can potentially expose sensitive data or internal systems, which may impact compliance with GDPR (data protection) or HIPAA (healthcare data privacy) if exploited. However, specific compliance impacts are not detailed in the provided context.

Mitigation Strategies

Immediately update netease-youdao LobsterAI to the latest patched version to address the server-side request forgery vulnerability in the OpenClawConfigSync.buildBrowserConfig function.

Hi! I’m here to help you understand CVE-2026-90818. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70