CVE-2026-90818: SSRF in browser network config sync

CISO Take

CVE-2026-90818 is a server-side request forgery flaw in NetEase Youdao's LobsterAI desktop AI agent, in the OpenClawConfigSync.buildBrowserConfig function, which lets a remote attacker make the application issue requests to destinations of their choosing. Severity is medium (CVSS 4.3), and the confidentiality impact is limited, but a public proof-of-concept exists and the vendor's GitHub issue was auto-closed for inactivity, so no fix should be assumed. The EPSS score is 0.54%, which puts it in the top 56% for exploitation likelihood. It is not in CISA KEV and SSVC says only to track, so this is not a breaking-alert event. Inventory any LobsterAI installs (versions 2026.6.15, 2026.8.28, 2026.9.3, 2026.9.4), restrict agent egress to internal metadata and management endpoints, and watch the upstream repository for a fix.

Sources:NVDEPSSATLASVulDBGitHub

What is the risk?

Overall risk is low to medium. The vector is network-based with low complexity and no privileges, but it needs user interaction and only affects confidentiality at a low level (C:L). A public PoC lowers the barrier to exploitation. EPSS of 0.00538 and the lack of KEV listing indicate little observed exploitation. The risk rises if the agent runs on a host with access to cloud metadata services or internal admin interfaces, because SSRF can then expose internal data. The absence of a vendor response means exposure may persist.

How does the attack unfold?

Initial Access

Attacker delivers a crafted link or content to a user of the LobsterAI agent.

AML.T0049

Exploitation

buildBrowserConfig processes the attacker-controlled input and the application issues server-side requests to an attacker-chosen destination.

Impact

Internal services or metadata endpoints are reached, leaking limited confidential data from the host's network.

Initial Access

Attacker delivers a crafted link or content to a user of the LobsterAI agent.

AML.T0049

Exploitation

buildBrowserConfig processes the attacker-controlled input and the application issues server-side requests to an attacker-chosen destination.

Impact

Internal services or metadata endpoints are reached, leaking limited confidential data from the host's network.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

INone

ANone

What should I do?

6 steps

Identify LobsterAI installs on versions 2026.6.15, 2026.8.28, 2026.9.3 and 2026.9.4.
Check the upstream repository (netease-youdao/LobsterAI) and issue #2181 for a patched release, and upgrade as soon as one is available.
Until then, apply egress filtering on hosts running the agent: block access to link-local metadata addresses (169.254.169.254), RFC1918 ranges and localhost services that are not required.
Avoid running the agent on hosts that hold cloud credentials or have access to sensitive internal services.
Monitor outbound connections from the application for unexpected internal destinations, and train users not to open untrusted links or content inside the agent.
Consider removing the product if the vendor stays unresponsive.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAgentFrameworkAML.T0049- Exploit Public-Facing Application AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and AI system failures

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-90818?

CVE-2026-90818 is a server-side request forgery flaw in NetEase Youdao's LobsterAI desktop AI agent, in the OpenClawConfigSync.buildBrowserConfig function, which lets a remote attacker make the application issue requests to destinations of their choosing. Severity is medium (CVSS 4.3), and the confidentiality impact is limited, but a public proof-of-concept exists and the vendor's GitHub issue was auto-closed for inactivity, so no fix should be assumed. The EPSS score is 0.54%, which puts it in the top 56% for exploitation likelihood. It is not in CISA KEV and SSVC says only to track, so this is not a breaking-alert event. Inventory any LobsterAI installs (versions 2026.6.15, 2026.8.28, 2026.9.3, 2026.9.4), restrict agent egress to internal metadata and management endpoints, and watch the upstream repository for a fix.

Is CVE-2026-90818 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-90818, increasing the risk of exploitation.

How to fix CVE-2026-90818?

1. Identify LobsterAI installs on versions 2026.6.15, 2026.8.28, 2026.9.3 and 2026.9.4. 2. Check the upstream repository (netease-youdao/LobsterAI) and issue #2181 for a patched release, and upgrade as soon as one is available. 3. Until then, apply egress filtering on hosts running the agent: block access to link-local metadata addresses (169.254.169.254), RFC1918 ranges and localhost services that are not required. 4. Avoid running the agent on hosts that hold cloud credentials or have access to sensitive internal services. 5. Monitor outbound connections from the application for unexpected internal destinations, and train users not to open untrusted links or content inside the agent. 6. Consider removing the product if the vendor stays unresponsive.

What systems are affected by CVE-2026-90818?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, desktop AI agents, browser automation agents.

What is the CVSS score for CVE-2026-90818?

CVE-2026-90818 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

agent frameworksdesktop AI agentsbrowser automation agents

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0112.000Local AI Agent

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Exploitation Scenario

An attacker prepares a crafted link or content that influences the browser network configuration processed by LobsterAI. A user opens it in the agent (user interaction required), and buildBrowserConfig builds a configuration that causes the application to send requests to an attacker-chosen internal address, such as a cloud metadata service or an internal admin panel. The responses are exposed or reflected in a way the attacker can observe, leaking internal data or credentials that support further lateral movement.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.