GHSA-j4c5-89f5-f3pm: Server-Side Request Forgery via CDP Profile Configuration in OpenClaw Vulnerability ID: GHSA-J4C5-89F5-F3PM CVSS Score: Not Assigned Published: 2026-04-25 OpenClaw versions prior to 2026.4.18 are vulnerable to a Server-Side Request Forgery (SSRF) flaw due to improper state merging. The application automatically extracted hostnames defined in Chrome DevTools Protocol (CDP) profile configurations and incorrectly appended them to the global SSRF navigation allowlist. This behavior allowed attackers or malicious configurations to authorize automated browser navigation to restricted internal networks and cloud metadata services. TL;DR A flaw in OpenClaw's configuration parsing merged backend CDP hostnames into the frontend browser navigation allowlist, enabling SSRF bypasses against restricted internal networks.…