CVE-2026-42436 Overview
CVE-2026-42436 is an improper access control vulnerability in OpenClaw before version 2026.4.14. The flaw exists in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass Server-Side Request Forgery (SSRF) restrictions and expose internal or disallowed page content. The issue is tracked under CWE-862: Missing Authorization and stems from route-driven navigation that does not re-validate SSRF policy after the target changes.
Critical Impact
Authenticated attackers can bypass SSRF policy controls to capture screenshots and snapshots of internal pages that should be inaccessible, leading to confidentiality loss across subsequent components.
Affected Products
- OpenClaw versions prior to 2026.4.14
- OpenClaw browser extension routes (snapshot, screenshot, tab)
- Deployments relying on BrowserNavigationPolicyOptions.ssrfPolicy for access control
Discovery Timeline
- 2026-05-05 - CVE-2026-42436 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-42436
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery (SSRF) policy bypass caused by missing authorization on browser automation routes. OpenClaw exposes routes that take browser snapshots, capture screenshots, and manipulate tabs. These routes invoke navigation logic but do not re-evaluate the SSRF policy against the final URL the browser settles on.
When an authenticated caller triggers navigation, the browser may end up on an internal or disallowed target. The snapshot and screenshot handlers then return rendered content from that target, exposing data the SSRF policy was designed to block. New tabs opened during navigation are also not validated against the policy.
Root Cause
The root cause is that the agent.snapshot.ts, agent.screenshot, and tab handling routes invoke browser actions without calling assertBrowserNavigationResultAllowed against the resolved tab URL. The policy is configured but never enforced at the response stage. New tabs opened during a session are similarly not enumerated and validated, allowing content from disallowed origins to be rendered and returned.
Attack Vector
An authenticated attacker submits a request to a snapshot, screenshot, or tab route that triggers navigation to an attacker-influenced URL. Through redirects, scripted navigation, or new tab creation, the final browser target lands on an internal resource. The route returns the page contents to the caller without re-validating the SSRF policy.
// Security patch in extensions/browser/src/browser/routes/agent.snapshot.ts
// Adds SSRF policy enforcement before returning screenshot content
targetId,
run: async ({ profileCtx, tab, cdpUrl }) => {
if (getBrowserProfileCapabilities(profileCtx.profile).usesChromeMcp) {
const ssrfPolicyOpts = withBrowserNavigationPolicy(ctx.state().resolved.ssrfPolicy);
if (element) {
return jsonError(res, 400, EXISTING_SESSION_LIMITS.snapshot.screenshotElement);
}
if (ssrfPolicyOpts.ssrfPolicy) {
await assertBrowserNavigationResultAllowed({
url: tab.url,
...ssrfPolicyOpts,
});
}
const buffer = await takeChromeMcpScreenshot({
profileName: profileCtx.profile.name,
userDataDir: profileCtx.profile.userDataDir,
Source: GitHub commit b75ad800
Detection Methods for CVE-2026-42436
Indicators of Compromise
- Requests to /snapshot, /screenshot, or tab routes that resolve to internal IP ranges (RFC1918, link-local, loopback)
- Browser automation logs showing final tab URLs that diverge from the originally requested URL
- New tabs created during a session with target URLs outside the configured SSRF allowlist
- Outbound responses containing rendered content from internal services (metadata endpoints, admin panels)
Detection Strategies
- Audit OpenClaw access logs for snapshot and screenshot requests followed by navigation events to disallowed hosts
- Compare requested URLs against final tab.url values recorded by Chrome DevTools Protocol traces
- Flag any session where initialTabTargetIds does not match the set of tabs present at response time
Monitoring Recommendations
- Forward OpenClaw application and browser automation logs to a centralized logging platform for correlation
- Alert on screenshot or snapshot responses larger than baseline when destinations are internal IPs
- Monitor egress proxy logs for browser-driven requests to cloud metadata services such as 169.254.169.254
How to Mitigate CVE-2026-42436
Immediate Actions Required
- Upgrade OpenClaw to version 2026.4.14 or later, which enforces SSRF policy on the affected routes
- Restrict authenticated access to OpenClaw browser routes to trusted users only
- Place OpenClaw behind an egress filter that blocks traffic to internal networks and cloud metadata endpoints
Patch Information
The fix is delivered in commit b75ad800a59009fc47eaa3471410f69046150e59. The patch adds assertBrowserNavigationResultAllowed calls in the snapshot, screenshot, and tab routes, and introduces an assertNewTabsAllowed helper that validates any new tabs created during a session against initialTabTargetIds. See the GitHub Security Advisory GHSA-c4qm-58hj-j6pj and the VulnCheck Advisory for details.
Workarounds
- Disable snapshot, screenshot, and tab routes if upgrading is not immediately feasible
- Enforce network-level egress controls that prevent the browser worker from reaching internal address ranges
- Require additional authorization checks at a reverse proxy in front of OpenClaw browser routes
# Example egress restriction using iptables to block internal targets from the browser worker
iptables -A OUTPUT -m owner --uid-owner openclaw -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
