OpenClaw before version 2026.4.14 suffers from a server-side request forgery vulnerability due to an insecure default browser SSRF policy, permitting internal network access.

This is a server-side request forgery (SSRF) flaw caused by an insecure default in the browser SSRF policy, requiring low privileges for successful exploitation.

A successful exploit allows malicious actors to access internal network services and sensitive metadata endpoints that are typically shielded from external access. This could lead to internal reconnaissance, unauthorized service enumeration, or the exposure of internal system configurations. Given the high CVSS score of 7.7, organizations face significant risk to their internal infrastructure confidentiality and network perimeter security.

Immediate Action: Update npm package openclaw to version 2026.4.14 or later to fix the browser SSRF policy.

Proactive Monitoring: Monitor network traffic for anomalous outbound requests originating from the OpenClaw instance toward internal IP ranges or cloud metadata endpoints.

Compensating Controls: Implement strict egress filtering and network segmentation to restrict outbound connections from the affected server to internal network resources.

Public Exploit Available: No

Administrators must treat this high-severity vulnerability with urgency by updating the OpenClaw package to version 2026.4.14 immediately. Ensuring that private-network navigation is blocked by default prevents attackers from pivoting into internal environments via browser-driven requests.