CVE-2026-42436: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-42436 is an improper access control vulnerability in OpenClaw (npm package) affecting all versions before 2026.4.14. The flaw exists in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after route-driven navigation, allowing authenticated callers to bypass Server-Side Request Forgery (SSRF) restrictions and expose internal or disallowed page content. The advisory was published on May 5, 2026, with the underlying GitHub Security Advisory (GHSA-c4qm-58hj-j6pj) published April 16, 2026. It carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-862 (Missing Authorization): the snapshot, screenshot, and tab routes in OpenClaw's browser extension performed SSRF policy checks at the initial navigation stage but did not re-validate the final browser target URL after route-driven navigation completed. This means an authenticated caller could initiate a navigation to an allowed URL, trigger a redirect or tab-open to an internal/disallowed resource (e.g., http://169.254.169.254/latest/meta-data/), and then invoke the snapshot or screenshot route — which would return content from the disallowed destination without re-checking the SSRF policy. The fix (commit b75ad800) adds a post-navigation call to assertBrowserNavigationResultAllowed in both the snapshot/screenshot routes and the act route's interaction guard, and also introduces checks for newly opened tabs against the configured SSRF policy (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker to bypass SSRF restrictions and read the content of internal or otherwise disallowed pages — including cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) or other internal network resources accessible to the OpenClaw server. The impact is limited to confidentiality (no integrity or availability impact), but exposure of internal metadata or credentials via cloud metadata services could enable privilege escalation or lateral movement within a cloud environment (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires authentication (low privileges), no user interaction, and network access, making it exploitable by any authenticated user of an OpenClaw instance with a restrictive SSRF policy configured. The EPSS score is approximately 0.027% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was responsibly disclosed by researcher @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer (GitHub Advisory).

1. Authenticate: Obtain valid credentials or an API token for an OpenClaw instance running a version prior to 2026.4.14 with a restrictive SSRF policy (e.g., allowPrivateNetwork: false) configured.
2. Initiate navigation to an allowed URL: Use the browser agent act route to navigate the browser to a permitted external URL, establishing an initial allowed session.
3. Trigger navigation to an internal resource: Exploit route-driven navigation (e.g., via a click action or redirect) to cause the browser to navigate to or open a new tab pointing to an internal/disallowed resource such as http://169.254.169.254/latest/meta-data/ (AWS instance metadata) or another internal endpoint.
4. Invoke snapshot or screenshot route: Call the /snapshot (GET) or /screenshot (POST) route. Because the pre-fix code did not re-validate the final browser target URL against the SSRF policy, the route returns the page content of the internal resource.
5. Exfiltrate data: Parse the returned snapshot or screenshot content to extract sensitive information such as cloud instance metadata, internal service responses, or credentials (GitHub Advisory, Fix Commit).

• Network: Outbound HTTP requests from the OpenClaw server process to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) initiated by the browser automation component; unexpected responses from cloud metadata endpoints in application logs.
• Logs: OpenClaw access logs showing authenticated calls to /snapshot or /screenshot routes immediately following navigation actions to external URLs; sequences of act-route requests followed by snapshot/screenshot requests in rapid succession from the same authenticated session.
• Process/Behavior: Browser process (e.g., Chrome/Chromium) making connections to internal network addresses or metadata services that are outside normal browsing patterns; new browser tabs opened to internal IP addresses during automated sessions.

Users should upgrade OpenClaw (npm package openclaw) to version 2026.4.14 or later, which enforces SSRF policy re-validation on snapshot, screenshot, and tab routes after navigation, and checks newly opened tabs against the configured policy. No configuration-based workaround is available for the missing post-navigation validation; upgrading is the only complete remediation. As a partial risk reduction, operators can restrict authenticated access to OpenClaw browser routes to trusted users only and ensure SSRF policies are strictly configured (GitHub Advisory, Fix Commit).

The vulnerability was reported by security researcher @zsxsoft with sponsorship from Keen Security Lab (@KeenSecurityLab) and @qclawer, indicating involvement from a well-known security research team. A brief mention appeared on Mastodon via @thehackerwire shortly after disclosure. Coverage has been limited to automated CVE aggregation sites (VulnDB, CVEFeed, RedPacket Security) with no major media coverage or significant community debate, consistent with the moderate severity rating (GitHub Advisory).