GHSA-hcm3-8f6r-6xwg: OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

OpenClaw's browser tool applies a network policy that blocks private-network destinations, as an SSRF guard. When a tab was already open and blocked, the debug and export routes could still reference it and reuse it. They did not reapply the policy (CWE-862). The advisory does not name the routes or the check that was skipped.

The attacker must be able to call the browser debug or export routes and refer to an open tab. The CVSS 3.1 vector is network, high complexity, low privileges, with user interaction required and changed scope. Confidentiality impact is high and integrity impact is low. The result is that page content from a private-network site, such as an internal admin page, can be inspected or exported. The tab may have been opened earlier by a user or by the agent.

How much this matters depends on what private-network content your browser sessions reach and who can use the debug routes. The advisory leaves OpenClaw's trusted-operator model unchanged.

Affected: npm openclaw before 2026.4.29. You are exposed if the browser feature and its debug or export routes are enabled and reachable.

npm ls -g openclaw

Drop -g for a project install. Check which users or agents can reach the browser debug routes.

Update to openclaw 2026.4.29, the first stable patched version.

npm install -g [email protected]

Until you can update, close blocked tabs before you use debug or export, and restrict the browser debug routes. The advisory also suggests narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the feature if you do not need it.

The advisory gives no log line. List the open browser tabs and look for any that point at private-network or internal addresses that the policy should block. Review calls to the browser debug and export routes, and compare them against which tabs were open at the time. Check agent transcripts for exports of internal pages. Beam records agent MCP tool calls and shell commands, which can show when an agent drove the browser.

Summary

Browser debug/export routes could reuse already-open blocked tabs. In affected versions, a caller that can reference an already-open browser tab could reuse blocked private-network tabs without reapplying the expected SSRF policy.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could export or inspect content from a tab that should have stayed behind the browser network policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.4.29.

Mitigations

close blocked tabs before debug/export use and restrict browser debug routes until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.