https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T06:32:27.744759+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-42439 CVE-2026-42439 — OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes 2026-09-29T06:32:27.747493+00:00

Affected: OpenClaw

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

 https://db.gcve.eu/vuln/ghsa-rj2p-j66c-mgqh GHSA-rj2p-j66c-mgqh — OpenClaw: Browser tabs action select and close routes bypassed SSRF policy 2026-09-29T06:32:27.747595+00:00

Affected: npm: openclaw

## Summary

Browser tabs action select and close routes bypassed SSRF policy.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.10` - Patched versions: `>= 2026.4.10`

## Impact

The browser `/tabs/action` select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.

## Technical Details

The fix enforces browser SSRF policy in the select and close tab-action branches.

## Fix

The issue was fixed in #63332. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `48c0347921b7e9438af0312968fc360ca88023f3` - PR: #63332

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @tdjackey for reporting this issue.