CVE-2026-45000 LOW

CVE-2026-45000: OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation

Vendor Openclaw
Product OpenClaw
Weakness CWE-918 · SSRF
Published May 11, 2026
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed during normal profile status operations.

Key dates

02Disclosure timeline

May 11, 2026 CVE published
May 11, 2026 Record updated