CVE-2026-62227: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-62227 is a Server-Side Request Forgery (SSRF) vulnerability in OpenClaw's browser snapshot routes that fail to validate post-navigation destinations. Affecting OpenClaw versions 2026.4.14 through 2026.5.25 (Node.js package), it allows authenticated users with lower-trust access to bypass OpenClaw policy checks and reach network destinations that should have been blocked. The vulnerability was published on July 17, 2026, with the advisory originally authored by joshavant and credited to researchers zsxsoft and KeenSecurityLab. It carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where OpenClaw's browser snapshot routes perform initial destination validation but fail to re-validate the final destination after browser navigation redirects occur (post-navigation). This means an attacker can craft a request that initially appears to target an allowed destination, but after navigation the browser snapshot mechanism follows redirects to a blocked internal or restricted network resource without re-applying policy checks. Exploitation requires low privileges (authenticated lower-trust access) and network-level access to the OpenClaw instance; no user interaction is needed. The attack requires specific deployment conditions (Attack Requirements: Present in CVSS v4.0), meaning the browser snapshot feature must be enabled and reachable by the attacker (GitHub Advisory, Github Advisory).

Successful exploitation allows an authenticated lower-trust user to bypass OpenClaw's network policy controls and access internal or restricted network resources that should be unreachable, resulting in a high confidentiality impact on subsequent systems. There is no integrity or availability impact — the vulnerability is limited to unauthorized information disclosure from internal network destinations. Practical impact depends heavily on the operator's configuration, the sensitivity of resources reachable from the OpenClaw server's network position, and whether lower-trust input can reach the affected browser snapshot routes (GitHub Advisory, Feedly).

1. Reconnaissance: Identify an OpenClaw instance running a vulnerable version (2026.4.14 to < 2026.5.26) with the browser snapshot feature enabled and accessible to lower-trust authenticated users.
2. Authenticate: Obtain lower-trust credentials for the OpenClaw instance (e.g., a standard user account, free trial, or shared gateway access).
3. Identify the browser snapshot route: Locate the browser snapshot API endpoint within OpenClaw that accepts a URL or navigation target as input.
4. Craft a redirect-based payload: Construct a request targeting an initially allowed destination (passing the initial policy check) that subsequently redirects — via HTTP redirect, meta-refresh, or JavaScript navigation — to a blocked internal network destination (e.g., http://192.168.1.1/, http://169.254.169.254/ for cloud metadata, or other internal services).
5. Submit the request: Send the crafted browser snapshot request to the vulnerable route; OpenClaw validates the initial destination but fails to re-validate the post-navigation destination.
6. Retrieve the response: The snapshot result contains content from the blocked internal resource, which the attacker can read to exfiltrate sensitive information such as internal service responses, metadata credentials, or configuration data (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the OpenClaw server process to internal RFC-1918 addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata endpoints (e.g., 169.254.169.254) initiated by the browser snapshot feature; unusual connections to internal services not normally accessed by OpenClaw.
• Logs: OpenClaw access logs showing repeated or anomalous requests to browser snapshot routes from lower-trust user accounts; log entries showing navigation to destinations that differ from the initially requested URL; HTTP responses from internal hosts appearing in snapshot output logs.
• Application Behavior: Browser snapshot requests that resolve to internal IP addresses or hostnames; policy check logs showing an allowed initial destination followed by a redirect to a blocked destination without a corresponding policy denial event.

The primary remediation is to upgrade OpenClaw to version 2026.5.26 or later, which is the first stable patched release (GitHub Advisory). Before upgrading, operators should restrict the browser snapshot feature to trusted operators only or disable it entirely if not needed. As additional hardening measures: keep channel and tool allowlists narrow, avoid sharing a single Gateway between mutually untrusted users, implement network segmentation to restrict outbound connections from the OpenClaw application to only necessary destinations, and review access controls for browser snapshot routes (Github Advisory).

The advisory credits zsxsoft as the reporter and KeenSecurityLab as the sponsor, indicating coordinated disclosure with security research involvement (GitHub Advisory). VulnCheck assigned the CVE and published a corresponding advisory. No significant broader community discussion, media coverage, or notable researcher commentary beyond the initial disclosure has been observed at this time.