CVE-2026-41912: Openclaw SSRF Policy Bypass Vulnerability

CVE-2026-41912 Overview

CVE-2026-41912 is a Server-Side Request Forgery (SSRF) policy bypass vulnerability in OpenClaw versions before 2026.4.8. The flaw allows attackers to trigger navigations that bypass the application's SSRF protections. By leveraging browser-initiated interactions, an attacker can reach restricted internal resources that the SSRF allowlist is intended to block. The weakness is tracked under CWE-918 and affects OpenClaw deployments running on Node.js.

Critical Impact
Authenticated attackers can bypass SSRF allowlist controls through interaction-triggered navigations, gaining indirect access to internal services or metadata endpoints that should be unreachable from the OpenClaw component.

Affected Products

OpenClaw versions prior to 2026.4.8
OpenClaw deployments running on Node.js
Applications embedding OpenClaw for navigation or browser-driven workflows

Discovery Timeline

2026-04-28 - CVE-2026-41912 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-41912

Vulnerability Analysis

The vulnerability resides in OpenClaw's navigation handling logic. OpenClaw enforces SSRF checks against user-supplied URLs before issuing outbound requests. However, these checks are applied only at the initial request boundary and do not re-evaluate URLs reached through subsequent browser-driven navigations. An attacker can supply a permitted URL that the controlled origin then redirects or instructs the browser to follow toward an internal target. The browser interaction model effectively launders the request, allowing the second hop to reach hosts the SSRF policy was designed to block, including loopback addresses, link-local metadata services, and internal management interfaces.

Root Cause

The root cause is incomplete enforcement of the SSRF policy across the full navigation chain. The OpenClaw allowlist is consulted for the initial target only, while interaction-triggered transitions inherit trust from the originating navigation context. This deviates from the principle that every outbound destination must be independently validated against the SSRF policy.

Attack Vector

Exploitation requires network access to the OpenClaw component, low-privileged authentication, and a user interaction such as clicking or following an attacker-influenced link. The attacker hosts content on a domain that passes the initial SSRF allowlist check. When OpenClaw processes the navigation, the controlled origin issues a redirect or scripted navigation toward an internal host. The downstream navigation bypasses the SSRF gate and the internal request is executed in the OpenClaw server context. See the VulnCheck Advisory and the GitHub Security Advisory for additional technical detail.

No verified public proof-of-concept code is available at the time of writing. The vulnerability mechanism is described in prose; refer to the upstream advisory and fix commit for implementation specifics.

Detection Methods for CVE-2026-41912

Indicators of Compromise

Outbound HTTP requests from OpenClaw hosts targeting RFC1918 ranges, loopback (127.0.0.0/8), or cloud metadata endpoints such as 169.254.169.254.
Server logs showing navigation chains that begin at an allowlisted external host and terminate at an internal-only resource.
Unexpected redirect responses (3xx) returned to OpenClaw from external domains immediately preceding internal access attempts.

Detection Strategies

Inspect OpenClaw application logs for navigation events where the final resolved URL differs from the initially validated URL.
Correlate egress proxy logs with OpenClaw request IDs to identify navigation chains that cross trust boundaries.
Deploy network-layer rules that flag any traffic from OpenClaw service accounts toward internal management subnets.

Monitoring Recommendations

Force all OpenClaw outbound traffic through an egress proxy that enforces an independent destination allowlist.
Alert on DNS resolutions from OpenClaw hosts that return private, loopback, or link-local addresses.
Monitor cloud metadata service access (IMDS) from any host running OpenClaw and treat such access as high severity.

How to Mitigate CVE-2026-41912

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.8 or later as published in the GitHub Security Advisory.
Audit OpenClaw service accounts and restrict their network reachability to only the destinations required for business function.
Block OpenClaw hosts from reaching cloud instance metadata endpoints and internal management planes at the network layer.

Patch Information

The fix is delivered in OpenClaw 2026.4.8. Review the upstream patch in commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 for the exact changes applied to the navigation validation path. The patch extends SSRF checks to interaction-triggered navigations so each hop is independently evaluated.

Workarounds

Place OpenClaw behind an egress filtering proxy that enforces destination allowlists outside of OpenClaw's own logic.
Disable user-driven or interaction-triggered navigation features if they are not required by the deployment.
Restrict low-privileged user accounts that can submit URLs to OpenClaw until the patched release is deployed.

bash

# Configuration example: restrict OpenClaw egress with iptables
# Replace OPENCLAW_UID with the UID running the OpenClaw process
iptables -A OUTPUT -m owner --uid-owner OPENCLAW_UID -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner OPENCLAW_UID -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner OPENCLAW_UID -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner OPENCLAW_UID -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner OPENCLAW_UID -d 192.168.0.0/16 -j REJECT