CVE-2026-90818

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

• CWE-918

• https://gist.github.com/YLChen-007/e5f88777e7c50549fd98b23b2988f78d
• https://github.com/netease-youdao/LobsterAI/
• https://github.com/netease-youdao/LobsterAI/issues/2181
• https://vuldb.com/cve/CVE-2026-90818
• https://vuldb.com/submit/922881
• https://vuldb.com/vuln/403321
• https://vuldb.com/vuln/403321/cti

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90812A security vulnerability has been detected in cosmicstack-la…4.3
• CVE-2026-90813A vulnerability was detected in cosmicstack-labs mercury-age…4.3
• CVE-2026-90814A flaw has been found in cosmicstack-labs mercury-agent up t…6.3
• CVE-2026-90815A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6…6.3
• CVE-2026-90816A vulnerability was found in FFmpeg 8.0.x. This affects the …4.3
• CVE-2026-90817An unauthenticated Remote Code Execution vulnerability was f…9.8
• CVE-2026-90819A weakness has been identified in a2aproject a2a-java 1.2.0.…7.3
• CVE-2026-9082Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2026-90820A security vulnerability has been detected in a2aproject a2a…4.3
• CVE-2026-90821An input neutralization vulnerability in the Webhook URL for…5.4
• CVE-2026-90822FatPipe MPVPN, WARP, and IPVPN appliances running the end-of…9.8
• CVE-2026-90823FatPipe MPVPN, WARP, and IPVPN appliances running the end-of…9.8