CVE-2026-42430CWE-918

OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling

Medium · published April 28, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks. Attackers can exploit request-time navigation to reach private targets that should be restricted by browser SSRF protections.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00312 · 22.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling
    cvelistv5