What happened
NVD published CVE-2026-17458 (CVSS 6.3, Medium) on 2026-07-26, and a public exploit is already available. openclaw-cn is a fork/localization of the OpenClaw personal AI agent that exposes a browser-automation tool (Playwright-based) to the LLM; the SSRF guard only checks the initial navigation target, not URLs reached via subsequent click-driven navigation.
Why it matters
Browser-use/computer-use tools are a core agentic attack surface — this is a working, publicly-exploitable SSRF in an unmaintained (no vendor response) AI agent's browser tool, illustrating how partial SSRF guards on agentic navigation actions can be bypassed via interaction-driven redirects.
Attack vector
The clickViaPlaywright function in the Browser Control HTTP API (src/browser/routes/agent.act.ts) enforces SSRF protections on direct navigation but fails to re-validate the resulting URL after an interaction-driven navigation (e.g., a click that triggers a redirect or in-page navigation to an internal/loopback target). A remote attacker able to invoke the browser-control agent action can pivot it to fetch internal/private network resources.
Affected systems
mf-yang openclaw-cn up to 0.2.1
Mitigation
No vendor patch confirmed at time of writing; the maintainer was notified via an issue report but has not responded. Restrict the Browser Control HTTP API to trusted callers and network-segment the agent's browser sandbox until fixed.