CVE-2026-90818CWE-918ssrf

CVE-2026-90818

Medium · published September 15, 2026

CVSS v3.1

4.3

EPSS

Percentile

44.5

In the wild

Unconfirmed

What it is

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0: 5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS: 0.00538 · 44.5th percentile
Weakness: CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2026-09-15T01:17Z

References (7)

https://gist.github.com/YLChen-007/e5f88777e7c50549fd98b23b2988f78d · [email protected]https://github.com/netease-youdao/LobsterAI/ · [email protected]https://github.com/netease-youdao/LobsterAI/issues/2181 · [email protected]https://vuldb.com/cve/CVE-2026-90818 · [email protected]https://vuldb.com/submit/922881 · [email protected]https://vuldb.com/vuln/403321 · [email protected]https://vuldb.com/vuln/403321/cti · [email protected]

EPSS history

Timeline

17 SEP 03:33Z
EPSS moved — → 1%
epss
14 SEP 20:15Z
netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery
cvelistv5