CVE-2026-101883 in Windows
Summary
by MITRE • 09/30/2026
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability resides within OpenClaw Windows Node software versions up through 2026.9.4 and represents a critical server-side request forgery flaw specifically located in the canvas.present capability. This security defect allows an attacker who possesses gateway or agent access to manipulate the application into performing unintended network requests that circumvent existing URL risk evaluation mechanisms enforced by the canvas.navigate function. The core technical failure involves a lack of proper input validation and authorization checks when handling commands directed at the canvas.present endpoint, which fails to restrict the scope of URLs permitted for rendering within the embedded WebView component.
From an operational perspective, this vulnerability enables significant lateral movement and data exfiltration risks. By exploiting the canvas.present capability, malicious actors can force the node's internal WebView to initiate HTTP requests targeting localhost interfaces, private network segments, or services accessible via tailnet connections originating from the user's machine. This effectively bypasses standard browser security policies such as same-origin restrictions because the request is generated by a privileged application component rather than through direct user interaction in a sandboxed web context. The attacker can thus access internal APIs, database ports, or administrative interfaces that are not exposed to the public internet but remain vulnerable due to their accessibility from within the local network stack of the compromised node.
The security implications align closely with CWE-918 Server-Side Request Forgery (SSRF), as the application acts on user-supplied input by making requests to arbitrary destinations without adequate verification of the target's legitimacy or safety. Furthermore, this attack vector maps directly to MITRE ATT&CK technique T1557.002 Adversary-in-the-Middle via Lateral Tool Transfer, where the compromised node is used as a pivot point to interact with other internal systems. It also relates to CWE-94 Improper Control of Generation of Code (Code Injection) in the context of web views if script injection were possible, though the primary issue here is unauthorized network access rather than code execution per se. The ability to reach localhost services poses an immediate risk for accessing sensitive local applications such as database management tools, configuration panels, or internal monitoring dashboards that trust connections from 127.0.0.1 without additional authentication layers.
Mitigation strategies must focus on implementing strict allow-listing of permitted URLs and domains within the canvas.present implementation to ensure only expected external resources are loaded. Developers should enforce origin validation checks similar to those applied in canvas.navigate, ensuring that any request initiated by this capability undergoes rigorous risk evaluation before execution. Additionally, isolating the WebView process with restricted network permissions can prevent access to private IP ranges and loopback addresses unless explicitly authorized for specific trusted services. Network-level controls such as firewall rules restricting outbound connections from application processes to internal subnets provide a secondary layer of defense. Regular security audits focusing on input validation in all API endpoints exposed by OpenClaw components are essential to identify similar flaws across the platform before they can be exploited in production environments.