CVE-2026-17457: scheme handler bypass exposes data

CISO Take

openclaw-cn, an AI agent framework with browser-automation capabilities, ships a broken guardrail: the function that decides whether the agent's embedded browser is allowed to navigate to a given URL (assertBrowserNavigationAllowed) can be bypassed by manipulating the url argument, letting a remote party steer the agent's browser to schemes or destinations it should have blocked and leak information in the process. The bar to exploit is low — network-reachable, low complexity, no user interaction — but the confidentiality impact is capped (CVSS 4.3, C:L/I:N/A:N) and there's no EPSS score, no CISA KEV listing, and no public scanner or Nuclei template, so this reads as opportunistic rather than a mass-exploitation risk today. The bigger flag is process, not severity: the maintainer was notified via a GitHub issue and has gone silent, so there is no patched version to move to. Until that changes, treat this as a guardrail failure in an agentic browsing tool — restrict or disable the scheme-handler/navigation feature where it isn't essential, and add egress monitoring around any AI agent instance that uses openclaw-cn's browser tool for outbound requests to unexpected schemes or internal addresses.

Sources: NVD ATLAS vuldb.com

What is the risk?

Medium severity by CVSS (4.3) with a low-complexity, network attack vector and no privileges beyond PR:L, but scope is confined to confidentiality (C:L) with no integrity or availability impact. Real-world exploitation likelihood is hard to size precisely — EPSS is unavailable, it's not in CISA KEV, and there's no known scanner/Nuclei coverage — but the CVE record explicitly states the exploit has already been disclosed publicly, which lowers the bar for opportunistic abuse even without a formal PoC in this feed. The unresponsive maintainer (issue reported, no reply) means there is no near-term patch, turning this into an indefinite exposure for any deployment that hasn't mitigated at the configuration/network layer.

How does the attack unfold?

Craft malicious URL

Attacker constructs a URL designed to slip past the scheme handler's navigation validation logic.

AML.T0100

Bypass navigation guard

assertBrowserNavigationAllowed fails to reject the crafted URL, permitting the agent's browser to invoke navigation to a disallowed destination.

AML.T0053

Information disclosure

The agent's browser reaches the restricted resource and surfaces its contents back through the agent's normal output, exposing data the guard was meant to protect.

Craft malicious URL

Attacker constructs a URL designed to slip past the scheme handler's navigation validation logic.

AML.T0100

Bypass navigation guard

assertBrowserNavigationAllowed fails to reject the crafted URL, permitting the agent's browser to invoke navigation to a disallowed destination.

AML.T0053

Information disclosure

The agent's browser reaches the restricted resource and surfaces its contents back through the agent's normal output, exposing data the guard was meant to protect.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

No fixed version exists yet since the maintainer has not responded to the original report — track https://github.com/mf-yang/openclaw-cn/issues/561 for a patch. In the meantime: disable or heavily restrict the browser/scheme-handler feature if it isn't business-critical; if it must stay enabled, enforce an allowlist of schemes/domains at the network or proxy layer rather than relying solely on the in-app guard; monitor outbound requests from any host running openclaw-cn for navigation to unexpected schemes (file://, internal IPs, metadata endpoints); and if feasible, sandbox the browser component so a guard bypass can't reach sensitive local resources.

How is it classified?

Data Leakage Auth Bypass Agent AML.T0053 - AI Agent Tool Invocation AML.T0100 - AI Agent Clickbait

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated and documented

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-17457?

openclaw-cn, an AI agent framework with browser-automation capabilities, ships a broken guardrail: the function that decides whether the agent's embedded browser is allowed to navigate to a given URL (assertBrowserNavigationAllowed) can be bypassed by manipulating the url argument, letting a remote party steer the agent's browser to schemes or destinations it should have blocked and leak information in the process. The bar to exploit is low — network-reachable, low complexity, no user interaction — but the confidentiality impact is capped (CVSS 4.3, C:L/I:N/A:N) and there's no EPSS score, no CISA KEV listing, and no public scanner or Nuclei template, so this reads as opportunistic rather than a mass-exploitation risk today. The bigger flag is process, not severity: the maintainer was notified via a GitHub issue and has gone silent, so there is no patched version to move to. Until that changes, treat this as a guardrail failure in an agentic browsing tool — restrict or disable the scheme-handler/navigation feature where it isn't essential, and add egress monitoring around any AI agent instance that uses openclaw-cn's browser tool for outbound requests to unexpected schemes or internal addresses.

Is CVE-2026-17457 actively exploited?

No confirmed active exploitation of CVE-2026-17457 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17457?

No fixed version exists yet since the maintainer has not responded to the original report — track https://github.com/mf-yang/openclaw-cn/issues/561 for a patch. In the meantime: disable or heavily restrict the browser/scheme-handler feature if it isn't business-critical; if it must stay enabled, enforce an allowlist of schemes/domains at the network or proxy layer rather than relying solely on the in-app guard; monitor outbound requests from any host running openclaw-cn for navigation to unexpected schemes (file://, internal IPs, metadata endpoints); and if feasible, sandbox the browser component so a guard bypass can't reach sensitive local resources.

What systems are affected by CVE-2026-17457?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation / computer-use agents.

What is the CVSS score for CVE-2026-17457?

CVE-2026-17457 has a CVSS v3.1 base score of 4.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation / computer-use agents

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0100 AI Agent Clickbait

Compliance Controls Affected

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025, LLM06:2025

What are the technical details?

Original Advisory

A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker crafts a specially formed URL (e.g., via scheme confusion, encoding tricks, or a malicious link fed to the agent's browsing tool) that is passed to assertBrowserNavigationAllowed. The flawed validation logic fails to recognize it as disallowed, and the agent's embedded browser navigates to it anyway — reaching a local file path, internal network resource, or other origin the guard was supposed to block. The response or rendered content is then surfaced back through the agent's normal output channel, handing the attacker information they should never have had access to.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-284 Improper Access Control Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-284 Improper Access Control

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.