OpenClaw before version 2026.4.10 is vulnerable to a server-side request forgery policy bypass via the browser tabs action routes, allowing low-privileged authenticated users to bypass security controls and perform unauthorized tab navigation operations.

This missing authorization flaw (CWE-862) affects the /tabs/action endpoint, permitting low-privileged authenticated attackers to circumvent configured browser server-side request forgery policy protections.

A successful exploitation of this vulnerability permits unauthorized tab navigation operations, leading to potential internal resource access or unintended data exposure. Given the high CVSS score of 8.5, organizations face significant risk regarding confidentiality breaches and unauthorized interactions within internal network perimeters.

Immediate Action: Update the OpenClaw npm package to version 2026.4.10 or later immediately.

Proactive Monitoring: Monitor access logs for anomalous requests directed toward the /tabs/action endpoint or unusual tab navigation patterns.

Compensating Controls: Implement strict network egress filtering and Web Application Firewall rules to restrict outbound requests originating from the application server.

Public Exploit Available: No - unknown

Organizations utilizing OpenClaw must treat this vulnerability with high urgency despite the lack of active exploitation evidence. Administrators should apply the official package update to version 2026.4.10 immediately to eliminate the authorization bypass vector and secure internal browser actions.