| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.4.10 | 2026.4.10 |
| openclaw | < 2026.4.10 | 2026.4.10 |
Browser tabs action select and close routes bypassed SSRF policy.
openclaw< 2026.4.10>= 2026.4.10The browser /tabs/action select and close branches could operate on targets without enforcing configured browser SSRF policy, weakening tab-level navigation protections.
The fix enforces browser SSRF policy in the select and close tab-action branches.
The issue was fixed in #63332. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.
48c0347921b7e9438af0312968fc360ca88023f3Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.
Thanks to @tdjackey for reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free