CVE-2026-45000

OpenClaw before 2026.4.20 is affected by a server-side request forgery in the browser CDP profile creation flow. The vulnerability allows creation of stored profiles that can point to private-network or metadata endpoints and bypass strict-mode SSRF policy checks, with the sensitive endpoints pot...