CVE-2026-41912: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41912 is a Server-Side Request Forgery (SSRF) policy bypass vulnerability in OpenClaw, a user-controlled local AI assistant distributed as an npm package. Versions up to and including 2026.4.5 are affected; the issue was patched in version 2026.4.8. The vulnerability allows low-privileged attackers to trigger browser-based navigations that circumvent normal SSRF protection checks, potentially exposing restricted internal resources. It was published on April 28, 2026, with a CVSS v3.1 base score of 7.6 (High) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-918 (Server-Side Request Forgery), specifically a bypass of the fetchWithSsrFGuard network fetch guard in OpenClaw's src/infra/net/fetch-guard.ts. The fix commit (d7c3210) reveals that the guard incorrectly skipped DNS pinning when operating in TRUSTED_ENV_PROXY mode, even when no proxy environment variable was configured — allowing interaction-triggered navigations to bypass SSRF checks entirely. An attacker with low privileges can craft browser interactions that initiate navigations to restricted or internal network resources without triggering the expected SSRF policy enforcement. The fix adds a fallback to DNS pinning when no proxy environment variable is present in trusted proxy mode, and adds regression tests to prevent recurrence (GitHub Commit, GitHub Advisory).

Successful exploitation allows a low-privileged attacker to bypass SSRF protections and access restricted internal resources across network boundaries, resulting in high confidentiality impact to systems reachable from the OpenClaw host. Integrity impact is limited (rated Low), and there is no direct availability impact. Because OpenClaw is scoped as a user-controlled local assistant rather than a multi-tenant service, the practical blast radius depends on the network environment of the host running OpenClaw — in enterprise environments, this could expose internal APIs, metadata services, or other sensitive endpoints (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no confirmed in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.027%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access (low privilege) and user interaction, which reduces the likelihood of opportunistic mass exploitation.

1. Identify a target: Locate a host running OpenClaw npm versions ≤ 2026.4.5, accessible to the attacker (locally or over a network).
2. Authenticate: Obtain low-privileged access to the OpenClaw instance, as the vulnerability requires authenticated interaction.
3. Craft a malicious navigation trigger: Prepare a browser interaction (e.g., a crafted link, embedded resource, or UI action) that initiates a navigation request to a restricted internal resource (e.g., http://169.254.169.254/ for cloud metadata, or an internal API endpoint).
4. Trigger the bypass: Cause the OpenClaw browser component to process the crafted navigation while the TRUSTED_ENV_PROXY mode is active but no proxy environment variable is set — this causes the fetch guard to skip DNS pinning, allowing the request to proceed without SSRF policy enforcement.
5. Access restricted resources: The navigation reaches the internal or restricted resource, and the attacker can observe the response content, potentially exposing sensitive data such as credentials, internal service data, or cloud instance metadata (GitHub Advisory, GitHub Commit).

• Network: Unexpected outbound HTTP/HTTPS requests from the OpenClaw process to internal IP ranges (e.g., RFC 1918 addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (e.g., 169.254.169.254).
• Network: Navigation requests to internal hostnames or services that should not be reachable from the OpenClaw application context.
• Logs: OpenClaw application logs showing fetch requests to internal or restricted URLs that were not blocked by the SSRF guard.
• Process: The OpenClaw Node.js process initiating DNS lookups or TCP connections to internal network resources outside its expected operational scope.

Upgrade OpenClaw (npm package) to version 2026.4.8 or later, which contains the verified fix at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (GitHub Advisory, GitHub Commit). Until patching is complete, implement network-level egress controls to block OpenClaw from reaching internal IP ranges and sensitive endpoints. Restrict access to OpenClaw instances to trusted users only, and monitor for unusual outbound navigation or resource access patterns from authenticated sessions (Feedly).

The vulnerability was reported by researchers @ccreater222 and @KeenSecurityLab, with sponsorship credited to @qclawer, and was published as a GitHub Security Advisory by OpenClaw maintainer steipete on April 8, 2026 (GitHub Advisory). The advisory notes the vulnerability is scoped to OpenClaw's trust model as a user-controlled local assistant, not a multi-tenant service boundary, which contextualizes the moderate severity rating. No significant broader media coverage or social media discussion has been identified beyond standard CVE aggregator reporting.