CVE-2026-17458: unpatched SSRF — MEDIUM

CISO Take

A server-side request forgery flaw in openclaw-cn's Browser Control HTTP API lets a low-privileged remote attacker manipulate the clickViaPlaywright function to make the AI agent's headless browser issue requests on the attacker's behalf, potentially reaching internal services or cloud metadata endpoints normally shielded from the internet. This matters because a public exploit already exists and the maintainer has not responded to the original issue report, meaning there is no vendor patch or timeline in sight — any deployment running an exposed Browser Control API is exploitable today. The CVSS 6.3 rating (network, low complexity, low privileges, no user interaction) understates the real-world risk in agentic environments, since SSRF against an AI agent's browsing tool can pivot into credential theft or internal network reconnaissance. There is no EPSS score or KEV listing yet, so mass exploitation has not been observed, but the combination of a public PoC and an unresponsive vendor makes this a prime target for opportunistic scanning. Security teams running openclaw-cn (or derivatives) should immediately restrict network access to the Browser Control API, block outbound requests from the agent host to internal ranges and 169.254.169.254, and monitor for anomalous calls to the clickViaPlaywright endpoint until a fix ships.

Sources: NVD vuldb.com GitHub ATLAS

What is the risk?

Medium CVSS (6.3) but elevated real-world risk: network-exploitable, low attack complexity, no user interaction, and a public exploit already circulating. The vendor was notified via a GitHub issue but has not responded, so there is no patched version to upgrade to — this is effectively an indefinite 0-day until community pressure or a fork produces a fix. Confidentiality, integrity, and availability impacts are each individually rated 'low', but SSRF's real danger is indirect: it provides a foothold into internal-only assets (cloud metadata, internal APIs, admin panels) that the raw CVSS score doesn't capture. Exposure is highest for any deployment that exposes the Browser Control HTTP API beyond a trusted network boundary.

How does the attack unfold?

Entry point

Attacker with low-privilege API access sends a crafted request to the Browser Control HTTP API's clickViaPlaywright endpoint, supplying an attacker-chosen internal or malicious URL as the navigation target.

AML.T0049

Exploitation

The endpoint fails to validate the destination, so the server-side Playwright browser navigates to the attacker-supplied URL, causing the AI agent's host to issue an SSRF request on the attacker's behalf.

AML.T0053

Impact

The attacker retrieves responses from internal-only services or cloud metadata endpoints via the agent's browser proxy, gaining reconnaissance data or credentials that would otherwise be unreachable from outside the network.

Entry point

Attacker with low-privilege API access sends a crafted request to the Browser Control HTTP API's clickViaPlaywright endpoint, supplying an attacker-chosen internal or malicious URL as the navigation target.

AML.T0049

Exploitation

The endpoint fails to validate the destination, so the server-side Playwright browser navigates to the attacker-supplied URL, causing the AI agent's host to issue an SSRF request on the attacker's behalf.

AML.T0053

Impact

The attacker retrieves responses from internal-only services or cloud metadata endpoints via the agent's browser proxy, gaining reconnaissance data or credentials that would otherwise be unreachable from outside the network.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

No official patch exists (vendor unresponsive since the GitHub issue was filed) — treat this as unpatched. Immediate steps: (1) restrict network exposure of the Browser Control HTTP API to trusted/internal callers only, never expose it directly to the internet; (2) enforce an egress allowlist/deny-list on the host running the Playwright browser so it cannot reach internal ranges (RFC1918), localhost, or cloud metadata endpoints (169.254.169.254, metadata.google.internal, etc.); (3) validate and sanitize any URL or target parameter passed to clickViaPlaywright before allowing navigation; (4) monitor logs and network egress from the agent host for requests to internal IPs or metadata services as a detection signal; (5) track the upstream issue (github.com/mf-yang/openclaw-cn/issues/562) for a maintainer response, or fork and patch internally if the component is business-critical.

How is it classified?

Data Extraction Auth Bypass Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0100 - AI Agent Clickbait

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-17458?

A server-side request forgery flaw in openclaw-cn's Browser Control HTTP API lets a low-privileged remote attacker manipulate the clickViaPlaywright function to make the AI agent's headless browser issue requests on the attacker's behalf, potentially reaching internal services or cloud metadata endpoints normally shielded from the internet. This matters because a public exploit already exists and the maintainer has not responded to the original issue report, meaning there is no vendor patch or timeline in sight — any deployment running an exposed Browser Control API is exploitable today. The CVSS 6.3 rating (network, low complexity, low privileges, no user interaction) understates the real-world risk in agentic environments, since SSRF against an AI agent's browsing tool can pivot into credential theft or internal network reconnaissance. There is no EPSS score or KEV listing yet, so mass exploitation has not been observed, but the combination of a public PoC and an unresponsive vendor makes this a prime target for opportunistic scanning. Security teams running openclaw-cn (or derivatives) should immediately restrict network access to the Browser Control API, block outbound requests from the agent host to internal ranges and 169.254.169.254, and monitor for anomalous calls to the clickViaPlaywright endpoint until a fix ships.

Is CVE-2026-17458 actively exploited?

No confirmed active exploitation of CVE-2026-17458 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17458?

No official patch exists (vendor unresponsive since the GitHub issue was filed) — treat this as unpatched. Immediate steps: (1) restrict network exposure of the Browser Control HTTP API to trusted/internal callers only, never expose it directly to the internet; (2) enforce an egress allowlist/deny-list on the host running the Playwright browser so it cannot reach internal ranges (RFC1918), localhost, or cloud metadata endpoints (169.254.169.254, metadata.google.internal, etc.); (3) validate and sanitize any URL or target parameter passed to clickViaPlaywright before allowing navigation; (4) monitor logs and network egress from the agent host for requests to internal IPs or metadata services as a detection signal; (5) track the upstream issue (github.com/mf-yang/openclaw-cn/issues/562) for a maintainer response, or fork and patch internally if the component is business-critical.

What systems are affected by CVE-2026-17458?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation / computer-use agents.

What is the CVSS score for CVE-2026-17458?

CVE-2026-17458 has a CVSS v3.1 base score of 6.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation / computer-use agents

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0100 AI Agent Clickbait

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker with low-level API access (e.g., a valid but low-privilege API key or authenticated session) sends a crafted request to the Browser Control HTTP API's clickViaPlaywright endpoint, supplying an internal URL — such as a cloud metadata address or an internal admin panel — as the click/navigation target instead of a legitimate external page. Because the endpoint does not validate the destination, the server-side Playwright browser dutifully navigates there and returns the resulting page content or triggers backend requests, letting the attacker use the AI agent's network position to read internal-only data or interact with internal services it should never be able to reach, without needing direct network access themselves.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.