Medium severity · published Sep 30, 2026
CVE-2026-101883
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OW
OpenClaw Windows Node · OpenClaw
through 2026.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101883
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101883
vendor-advisory
https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q
patch
https://github.com/openclaw/openclaw-windows-node/commit/16528aadaa45d7bc6718b07ccf8b01f3eb033ad1
technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v2026.9.4/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1244-L1270
technical-description
https://github.com/openclaw/openclaw-windows-node/blob/v0.6.12/src/OpenClaw.Tray.WinUI/Windows/CanvasWindow.xaml.cs#L77-L109
third-party-advisory
https://www.vulncheck.com/advisories/openclaw-windows-node-through-2026.9.4-ssrf-via-canvas-present
More from OpenClaw Windows Node
8.8
CVE-2026-101882
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
8.8
CVE-2026-101880
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
7.5
CVE-2026-101884
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
6.5
CVE-2026-101881
OpenClaw Windows Node before 2026.7.1 Denial of Service
6.5
CVE-2026-101879
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization