CVE-2026-41912: Openclaw

High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access restricted resources.

Affected products

• Openclaw Openclaw: before 2026.4.8 (fixed in 2026.4.8)

Published 2026-04-28. Last modified 2026-06-17.