CVE-2026-41912
Last modified
CVE-2026-41912 is a high-severity vulnerability rated 7.6/10 on the CVSS scale. OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access restricted resources.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access restricted resources.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.4.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-41912?
How severe is CVE-2026-41912?
How do I fix CVE-2026-41912?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41907uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs…7.5
- CVE-2026-41908OpenClaw before 2026.4.20 contains a scope enforcement bypas…6.5
- CVE-2026-41909OpenClaw before 2026.4.20 contains an improper authorization…5.4
- CVE-2026-4191A flaw has been found in JawherKl node-api-postgres up to 2.…7.3
- CVE-2026-41910OpenClaw before 2026.4.8 omits owner-only enforcement for cr…4.3
- CVE-2026-41911OpenClaw before 2026.4.8 contains a filesystem policy bypass…6.5
- CVE-2026-41913OpenClaw before 2026.4.4 contains a race condition vulnerabi…6.3
- CVE-2026-41914OpenClaw before 2026.4.8 contains a server-side request forg…8.5
- CVE-2026-41915OpenClaw before 2026.4.8 fails to remove git plumbing enviro…6.1
- CVE-2026-41916OpenClaw before 2026.4.8 contains an authentication state ma…5.4
- CVE-2026-41917OpenKM 6.3.12 contains a local file inclusion vulnerability …6.9
- CVE-2026-41918A vulnerability has been identified in RUGGEDCOM RST2428P (6…5.9
Are you affected by CVE-2026-41912?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST