Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck

CVE-2026-101883OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

Medium 5.4

In plain English

A medium-severity server-side request forgery in OpenClaw Windows Node from OpenClaw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw Windows Node	0 – through 2026.9.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-7vch-pmw9-3g4q) vendor-advisory
https://github.com/openclaw/openclaw-windows-node/commit/16528aadaa45d7bc6718b07ccf8b01f3eb033ad1 patch
https://github.com/openclaw/openclaw-windows-node/blob/v2026.9.4/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1244-L1270 technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Tray.WinUI/Windows/CanvasWindow.xaml.cs#L77-L109 technical-description
VulnCheck Advisory: OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present third-party-advisory