CVE-2026-90818 Overview
CVE-2026-90818 is a server-side request forgery (SSRF) vulnerability affecting netease-youdao LobsterAI versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4. The flaw resides in the OpenClawConfigSync.buildBrowserConfig function within src/main/libs/openclawConfigSync.ts, which handles Browser Network Configuration. Attackers can manipulate this function to trigger outbound requests from the server to arbitrary destinations. The vulnerability is remotely exploitable and a public proof-of-concept has been released. The associated GitHub issue was closed automatically due to inactivity, and no vendor patch has been confirmed.
Critical Impact
Remote attackers can abuse the browser configuration handler to force the application to issue arbitrary network requests, potentially reaching internal services or metadata endpoints. User interaction is required to trigger the exploit path.
Affected Products
- netease-youdao LobsterAI 2026.6.15
- netease-youdao LobsterAI 2026.8.28
- netease-youdao LobsterAI 2026.9.3 and 2026.9.4
Discovery Timeline
- 2026-09-14 - CVE-2026-90818 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90818
Vulnerability Analysis
The defect is classified under [CWE-918] Server-Side Request Forgery. LobsterAI exposes a browser configuration synchronization path implemented in openclawConfigSync.ts. The OpenClawConfigSync.buildBrowserConfig function accepts attacker-influenced input used to construct outbound network requests. Because the destination is not validated against an allowlist or restricted to safe hosts, the application can be coerced into contacting arbitrary URLs, including internal-only endpoints unreachable from the public internet. EPSS data reports a probability of 0.506% for near-term exploitation. A public proof-of-concept is published as a GitHub Gist, increasing the likelihood of opportunistic use.
Root Cause
The root cause is missing validation of network destinations inside buildBrowserConfig. User-controlled configuration values flow into the browser network request pipeline without host, scheme, or address filtering. This allows attackers to specify targets such as 127.0.0.1, RFC1918 ranges, or cloud metadata services (for example 169.254.169.254).
Attack Vector
Exploitation occurs over the network and requires user interaction, consistent with the CVSS 4.0 vector reporting AV:N, AC:L, and UI:P. An attacker crafts a malicious browser network configuration payload and induces a user or automated sync process to load it. When LobsterAI processes the payload, the vulnerable function issues the attacker-directed request. Refer to the GitHub Gist PoC and the LobsterAI issue tracker entry for technical details.
// No verified exploit code is reproduced here.
// See the linked GitHub Gist for the published proof-of-concept.
Detection Methods for CVE-2026-90818
Indicators of Compromise
- Outbound HTTP/HTTPS requests originating from the LobsterAI process to internal RFC1918 addresses or loopback interfaces.
- Requests from LobsterAI to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
- Unexpected modifications to browser network configuration values synchronized via openclawConfigSync.ts.
Detection Strategies
- Instrument the host to log all outbound connections initiated by the LobsterAI binary and alert on non-approved destinations.
- Inspect application logs for calls to OpenClawConfigSync.buildBrowserConfig with URL parameters pointing to private address space.
- Deploy egress web proxies that block non-allowlisted destinations and record blocked attempts for review.
Monitoring Recommendations
- Baseline the normal set of hosts LobsterAI contacts and alert on deviations.
- Monitor cloud metadata service access logs for requests attributable to workstations running LobsterAI.
- Correlate configuration sync events with subsequent outbound network activity to identify SSRF exploitation attempts.
How to Mitigate CVE-2026-90818
Immediate Actions Required
- Restrict LobsterAI outbound network access to a vetted allowlist using host firewall or egress proxy controls.
- Block LobsterAI from reaching cloud metadata IP ranges and internal management networks.
- Educate users to avoid importing untrusted browser configuration files or sync sources.
Patch Information
No vendor patch is currently referenced in the NVD entry, and the upstream GitHub issue #2181 was closed automatically due to inactivity. Monitor the netease-youdao LobsterAI repository and the VulDB advisory for updated fix information.
Workarounds
- Isolate systems running affected LobsterAI versions on network segments without access to sensitive internal services.
- Disable or bypass the browser network configuration sync feature until a patched release is available.
- Enforce outbound DNS and HTTP filtering to drop requests targeting loopback, link-local, and private address ranges.
# Example egress restriction using iptables to block SSRF-relevant destinations
iptables -A OUTPUT -m owner --uid-owner lobsterai -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lobsterai -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lobsterai -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lobsterai -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lobsterai -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
