CVE-2026-62201-OpenClaw-SSRF

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy Bypass SSRF Severity: High · CVSS: 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · CWE-918 Server-Side Request Forgery Vulnerability at a Glance Field| Value ---|--- Advisory| GHSA-mgvr-6gvw-3rgr NVD| CVE-2026-62201 Product| OpenClaw...

Exploit for Server-Side Request Forgery in Openclaw

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy B...

CVE-2026-62201

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the exec-server. An attacker can access internal network resources that are intended to be restricted by sending crafted HTTP requests through the...

EUVD-2026-45090

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

CVE-2026-62201 OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

CVE-2026-62201 OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

CVE-2026-62201

OpenClaw prior to version 2026.6.6 contains a network policy bypass in the sandbox exec-server that lets lower-trust callers reach internal network destinations blocked by policy. Attackers can send HTTP requests through the exec-server to access restricted network resources. The CVE description ...

CVE-2026-62201

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

CVE-2026-62201 OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

CVE-2026-62201: Server-Side Request Forgery (SSRF)

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...

ai.databand.azkaban:azkaban-exec-server (3.18.0), ai.grakn:grakn-dist (>=0.10.0, <=0.15.0) +809 more potentially affected by CVE-2017-12610 via org.apache.kafka:kafka-clients (>=0.10.0.0, <=0.10.2.1)

org.apache.kafka:kafka-clients MAVEN version =0.10.0.0, =0.10.0, =0.10.0, =0.10.0, =0.2, =1.0.0, =1.1.10, =1.2.0 and more Source cves: CVE-2017-12610 Source advisory: GHSA-XM78-4M3G-7WM7...

ai.databand.azkaban:az-core (3.90.0), ai.databand.azkaban:azkaban-common (3.18.0) +3318 more potentially affected by CVE-2019-13990 via org.quartz-scheduler:quartz (>=1.7.2, <=2.3.1)

org.quartz-scheduler:quartz MAVEN version =1.7.2, =0.5.0, =1.0.0, =1.1.0 - at.chrl:chrl-database 1.0.0 - at.chrl:chrl-orm 1.1.0 and more Source cves: CVE-2019-13990 Source advisory: MEND:CVE-2019-13990...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2014-0050 via commons-fileupload:commons-fileupload (>=1.0-beta-1, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0-beta-1, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2014-0050 Source advisory: OSV:GHSA-XX68-JFCG-XMMF...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2014-0050 via commons-fileupload:commons-fileupload (>=1.0, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2014-0050 Source advisory: MEND:CVE-2014-0050...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2013-2186 via commons-fileupload:commons-fileupload (>=1.0, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2013-2186 Source advisory: MEND:CVE-2013-2186...

Symantec Backup Exec Server Multiple Vulnerabilities (SYM13-009)

According to its version number, the Symantec Backup Exec Server installed on the remote Windows host is affected by multiple vulnerabilities : - Multiple cross-site scripting vulnerabilities exist in the management console and the beutility console. CVE-2013-4676 - Backup and restore data files...

CVE-2005-0771

CVE-2005-0771 affects VERITAS Backup Exec Server (beserver.exe) on Windows versions 9.0–10.0. It permits unauthenticated remote RPC access on TCP port 6106 that can modify the Windows registry, enabling an attacker to gain full registry control and potentially compromise the host. The vulnerabili...

CVE-2005-0771: Undefined Security Weakness

VERITAS Backup Exec Server beserver.exe 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify the registry by calling methods to the RPC interface on TCP port 6106...

[VulnWatch] Buffer overflow vulnerability in VERITAS Software Backup Exec Web Administration Console &#40;BEWAC&#41;

Mark Litchfield of NGSSoftware has discovered a high risk vulnerability in the in VERITAS Software Backup Exec Web Administration Console BEWAC which can allow for remote code execution. Affected Products include - Backup Exec 10.0 for Windows Servers rev. 5484 Backup Exec 9.1 for Windows Servers...