medium5.4
CVE-2026-100576
OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protectio…
Impact
OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or private destinations without navigation checks applied to other browser actions.
Affected products
| Product | Affected versions |
|---|---|
| OpenClaw | before 2026.8.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.