CVE-2026-62227: OpenClaw SSRF bypass

CISO Take

OpenClaw, a browser-automation AI agent framework, fails to re-validate navigation destinations after a page redirects post-load, letting a lower-privileged user or agent session reach internal network destinations that OpenClaw's own policy engine is supposed to block. This matters because it defeats the exact guardrail organizations rely on to keep agentic browsing contained — an attacker with only limited access (PR:L, no user interaction needed) can pivot the agent's network position to touch internal services, cloud metadata endpoints, or admin interfaces normally firewalled off from untrusted callers, with high confidentiality impact (CVSS 7.7, C:H). There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this is not under active mass exploitation, but the vendor advisory (GHSA-2x93-h3hg-2xfp) and a VulnCheck writeup both treat it as a real bypass, not theoretical. Patch to OpenClaw 2026.5.26 or later immediately; until patched, restrict which users/roles can trigger browser-snapshot routes and place an egress-filtering proxy in front of any OpenClaw browser session so redirect-driven destinations are enforced at the network layer, not just in-app policy.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk for any deployment that exposes OpenClaw's browser snapshot capability to multiple trust tiers (e.g., a shared agent instance serving both trusted operators and lower-privileged users or downstream agent calls). Exploitability is straightforward (AC:L, PR:L, no UI) — the flaw is a missing re-check after redirect, not a complex chain — but it requires network-level access to the OpenClaw service and the target internal destinations to actually exist and be reachable, which bounds the blast radius to environments where OpenClaw runs with broad network egress. No active exploitation or scanner coverage observed yet, but the scope-changed CVSS vector (S:C) reflects that the impact crosses the intended security boundary between the calling user and OpenClaw's internal network policy — exactly the kind of guardrail-defeat that raises risk for agent frameworks deployed with real network privileges.

How does the attack unfold?

Initial Access

A lower-trust user or downstream caller submits a browser-snapshot navigation request to a shared OpenClaw instance, using a URL that passes the initial destination policy check.

AML.T0053

Policy Bypass via Redirect

The attacker-controlled or malicious page triggers a post-load redirect or client-side navigation that OpenClaw fails to re-validate against its destination policy.

AML.T0049

SSRF to Internal Destination

OpenClaw's browser context follows the redirect and reaches an internal-only network destination that should have been blocked, such as an internal service or cloud metadata endpoint.

Impact

The attacker receives the resulting page content or metadata in the returned snapshot, achieving unauthorized disclosure of internal, high-confidentiality data.

Initial Access

A lower-trust user or downstream caller submits a browser-snapshot navigation request to a shared OpenClaw instance, using a URL that passes the initial destination policy check.

AML.T0053

Policy Bypass via Redirect

The attacker-controlled or malicious page triggers a post-load redirect or client-side navigation that OpenClaw fails to re-validate against its destination policy.

AML.T0049

SSRF to Internal Destination

OpenClaw's browser context follows the redirect and reaches an internal-only network destination that should have been blocked, such as an internal service or cloud metadata endpoint.

Impact

The attacker receives the resulting page content or metadata in the returned snapshot, achieving unauthorized disclosure of internal, high-confidentiality data.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I None

A None

What should I do?

1 step

Upgrade OpenClaw to 2026.5.26 or later, which fixes post-navigation destination validation. Until patched: (1) restrict which principals can invoke browser-snapshot/navigation routes to trusted operators only; (2) enforce network-level egress controls (firewall rules, network policies, or an authenticated forward proxy) around any host running OpenClaw so internal destinations are blocked regardless of in-app policy state; (3) disable or tightly scope redirect-following in browser snapshot configurations if a flag exists; (4) monitor OpenClaw's outbound connection logs for navigations to internal IP ranges, link-local addresses (169.254.0.0/16), or unexpected internal hostnames as a detection signal for exploitation attempts.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0100 - AI Agent Clickbait

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62227?

OpenClaw, a browser-automation AI agent framework, fails to re-validate navigation destinations after a page redirects post-load, letting a lower-privileged user or agent session reach internal network destinations that OpenClaw's own policy engine is supposed to block. This matters because it defeats the exact guardrail organizations rely on to keep agentic browsing contained — an attacker with only limited access (PR:L, no user interaction needed) can pivot the agent's network position to touch internal services, cloud metadata endpoints, or admin interfaces normally firewalled off from untrusted callers, with high confidentiality impact (CVSS 7.7, C:H). There's no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, so this is not under active mass exploitation, but the vendor advisory (GHSA-2x93-h3hg-2xfp) and a VulnCheck writeup both treat it as a real bypass, not theoretical. Patch to OpenClaw 2026.5.26 or later immediately; until patched, restrict which users/roles can trigger browser-snapshot routes and place an egress-filtering proxy in front of any OpenClaw browser session so redirect-driven destinations are enforced at the network layer, not just in-app policy.

Is CVE-2026-62227 actively exploited?

No confirmed active exploitation of CVE-2026-62227 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62227?

Upgrade OpenClaw to 2026.5.26 or later, which fixes post-navigation destination validation. Until patched: (1) restrict which principals can invoke browser-snapshot/navigation routes to trusted operators only; (2) enforce network-level egress controls (firewall rules, network policies, or an authenticated forward proxy) around any host running OpenClaw so internal destinations are blocked regardless of in-app policy state; (3) disable or tightly scope redirect-following in browser snapshot configurations if a flag exists; (4) monitor OpenClaw's outbound connection logs for navigations to internal IP ranges, link-local addresses (169.254.0.0/16), or unexpected internal hostnames as a detection signal for exploitation attempts.

What systems are affected by CVE-2026-62227?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation / computer-use agents.

What is the CVSS score for CVE-2026-62227?

CVE-2026-62227 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation / computer-use agents

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0100 AI Agent Clickbait

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked.

Exploitation Scenario

A lower-trust user of a shared OpenClaw deployment — for example, someone with API access to submit browser-snapshot jobs but not admin rights — submits a URL that passes OpenClaw's initial destination policy check (e.g., an external, allowed domain). That page then issues a redirect or client-side navigation to an internal-only target, such as a cloud metadata service or an internal admin API, which OpenClaw's snapshot engine follows without re-applying the policy check. The agent's browser context, running with network access to that internal destination, retrieves the response and includes it in the snapshot returned to the attacker — leaking internal service data or metadata credentials the attacker was never authorized to reach directly.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.