Description
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-26
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the clickViaPlaywright function of the Browser Control HTTP API in mf‑yang openclaw‑cn up to version 0.2.1. A crafted HTTP request can cause the server to perform arbitrary outbound requests on its behalf. The vulnerability is a classic server‑side request forgery (CWE‑918) that can be exercised remotely, allowing an attacker to make the server reach internal services, external websites, or other resources without proper validation.

Affected Systems

mf‑yang openclaw‑cn products utilizing the Browser Control HTTP API, specifically releases up to and including 0.2.1. No other vendors or products are presently listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate impact, while the EPSS score being below 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, triggered by maliciously crafted requests to the clickViaPlaywright endpoint. Successful exploitation could force the server to reach internal networks, exfiltrate data, or further propagate attacks. Due to the lack of a public patch, attackers may still perform the exploit by manipulating the API endpoint.

Generated by OpenCVE AI on August 3, 2026 at 18:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version of openclaw‑cn that includes a fix for the clickViaPlaywright SSRF vulnerability or apply a code patch from the project repository if available.
  • If an upgrade is not yet available, disable or restrict access to the Browser Control HTTP API until a patch is released to minimize the attack surface.
  • Implement firewall network segmentation rules that block unexpected outbound connections originating from the application, thereby limiting the damage a compromised SSRF can cause.

Generated by OpenCVE AI on August 3, 2026 at 18:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 26 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
First Time appeared Mf-yang
Mf-yang openclaw-cn
Weaknesses CWE-918
CPEs cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*
Vendors & Products Mf-yang
Mf-yang openclaw-cn
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mf-yang Openclaw-cn
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-27T13:49:45.592Z

Reserved: 2026-07-25T18:54:32.998Z

Link: CVE-2026-17458

cve-icon Vulnrichment

Updated: 2026-07-27T13:49:16.449Z

cve-icon NVD

Status : Deferred

Published: 2026-07-26T11:16:58.470

Modified: 2026-07-27T20:25:13.817

Link: CVE-2026-17458

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T18:30:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)