GitHub Advisoryadvisory · npm

GHSA-rj2p-j66c-mgqh OpenClaw: Browser tabs action select and close routes bypassed SSRF policy

MEDIUM Published 2026-04-17 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-42439
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-862, CWE-918
Reviewed
2026-04-17

Affected packages

• npm openclaw: < 2026.4.10 → fixed in 2026.4.10

Description

Summary Browser tabs action select and close routes bypassed SSRF policy. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `= 2026.4.10` Impact The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections. Technical Details The fix enforces browser SSRF policy in the select and close tab-action branches. Fix The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix. Fix Commit(s) • `48c0347921b7e9438af0312968fc360ca88023f3` • PR: #63332 Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. Credits Thanks to @tdjackey for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-42439 OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-918 Server-Side Request Forgery weakness

References