OpenClaw Browser SSRF Policy Bypass in Tab Actions

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

Casky was already ahead

This CVE exploits attack patterns that Casky's 358matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenClaw versions before 2026.4.10 suffer from a server-side request forgery (SSRF) policy bypass vulnerability in the browser tabs action select and close routes. The vulnerability exists because the /tabs/action endpoint fails to properly enforce configured SSRF protections, allowing attackers to circumvent security policies and perform unauthorized tab navigation operations. This affects any organization deploying OpenClaw for browser automation or tab management, particularly those relying on SSRF policies to restrict outbound requests to trusted destinations. With a CVSS score of 8.5, the high severity rating reflects the potential for attackers to access internal resources, interact with internal services, or pivot through the affected system—making this a critical issue for security teams to address immediately.

Casky's 358 matched security skills leverage Claude's extended reasoning to detect exploitation patterns across three key MITRE ATT&CK tactics: Initial Access (TA0001), Execution (TA0004), and Command & Control (TA0006). Practitioners using Casky would observe findings identifying suspicious /tabs/action endpoint requests that bypass policy validation (CWE-862: Missing Authorization), as well as unauthorized outbound requests that should have been blocked by SSRF controls (CWE-918: Server-Side Request Forgery). The platform's skill mapping would flag abnormal tab navigation sequences, requests to internal IP ranges or private hostnames, and policy enforcement gaps in browser automation workflows. Security teams would see correlated signals across execution and exfiltration patterns, enabling them to distinguish between legitimate tab operations and exploitation attempts that bypass intended security boundaries.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

358 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-42439.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006 TA0001

Investigate the attack patterns behind CVE-2026-42439

Casky has 358 skills that investigate the attack patterns behind CVE-2026-42439. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn