N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j4c5-89f5-f3pm

GHSA-j4c5-89f5-f3pm: OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

Browser profile creation normalized cdpUrl values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.

Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.

Fix

OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.

Fix commits:

1fd049e3074cac72f6734a7fe88468c84f5f8bd7
e90c89cf8b1459f2aa1f3a665be67392b6c03fdf

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j4c5-89f5-f3pm

GHSA-j4c5-89f5-f3pm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the browser profile creation process of OpenClaw. It allowed a user to specify a cdpUrl pointing to a private or internal network, bypassing the application's SSRF policy. The root cause lies in a change that automatically added any hostname from a cdpUrl in the configuration to the SSRF allowlist. This was done in the resolveBrowserConfig function, which used the helper function collectConfiguredCdpHostnames to extract the hostnames from user-provided configuration. This allowed a malicious cdpUrl to be saved without validation.

The vulnerability could then be triggered by "normal profile status flows," which use the resolveCdpReachabilityPolicy function to check if the CDP endpoint is available. The original implementation of this function did not correctly handle the SSRF policy for these checks in strict-mode deployments.

The fix involves two main changes. First, the automatic allowlisting of all cdpUrl hostnames was removed by deleting the collectConfiguredCdpHostnames function and reverting the changes in resolveBrowserConfig. Second, resolveCdpReachabilityPolicy was updated to granularly and temporarily allow the specific CDP host for a given profile during reachability checks, ensuring that only legitimate CDP endpoints can be contacted.

Vulnerable functions

resolveBrowserConfig

extensions/browser/src/browser/config.ts

This function is the entry point for processing the browser configuration. The vulnerability was introduced when this function was modified to use `collectConfiguredCdpHostnames` to gather all `cdpUrl` hostnames from the configuration and add them to the SSRF policy's allowlist. This meant that any hostname provided in a `cdpUrl`, including private or internal ones, would be trusted, creating a Server-Side Request Forgery (SSRF) vulnerability.

collectConfiguredCdpHostnames

extensions/browser/src/browser/config.ts

This function directly processes the user-controlled `cdpUrl`. It extracts the hostname from the provided URL and returns it to be added to the SSRF allowlist. This is the core of the vulnerability, as it allows a malicious actor to specify an internal or private hostname that will then be considered trusted by the application.

resolveCdpReachabilityPolicy

extensions/browser/src/browser/cdp-reachability-policy.ts

This function is used to determine the SSRF policy for checking if a CDP endpoint is reachable. Before the fix, it simply returned the existing global SSRF policy. This was insufficient because, in strict-mode deployments, it would not allow connections to legitimate private-network CDP endpoints for status checks. The vulnerability description notes that stored profiles could be "probed by normal profile status flows," which this function is a part of. The lack of a proper check here contributes to the impact of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.