SecBoard
Zurück zur CVE-Übersicht

CVE-2026-101883

MEDIUM(5.4)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Risk Signal Score14/100 — NIEDRIG
  • CVSS 5.4 — Mittel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

5.4

Technische Schwere

Beschreibung

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to localhost, private networks, or tailnet services from the user's machine.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • v2026.7.1-3

Threat-Hunting-Queries

Detects attempts to load URLs into the WebView that might bypass security checks, focusing on internal network access. Requires logging of WebView navigation attempts and their parameters.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName == "OpenClaw.Tray.WinUI.exe"
| where ProcessCommandLine contains "canvas.present" and (ProcessCommandLine contains "localhost" or ProcessCommandLine contains "10." or ProcessCommandLine contains "172.16." or ProcessCommandLine contains "192.168." or ProcessCommandLine contains "100.64.")

Splunk SPL

index=windows_events sourcetype=process_creation Image="*OpenClaw.Tray.WinUI.exe*" CommandLine="*canvas.present*" (CommandLine="*localhost*" OR CommandLine="*10.*" OR CommandLine="*172.16.*" OR CommandLine="*192.168.*" OR CommandLine="*100.64.*")

Sigma

title: OpenClaw Windows Node SSRF Attempt
status: experimental
description: Detects potential Server-Side Request Forgery attempts in OpenClaw Windows Node via canvas.present.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\OpenClaw.Tray.WinUI.exe'
    CommandLine|contains:
      - 'canvas.present'
      - 'localhost'
      - '10.'
      - '172.16.'
      - '192.168.'
      - '100.64.'
  condition: selection

Elastic ES|QL

FROM process WHERE process.executable : "*OpenClaw.Tray.WinUI.exe" AND process.command_line : "*canvas.present*" AND (process.command_line : "*localhost*" OR process.command_line : "*10.*" OR process.command_line : "*172.16.*" OR process.command_line : "*192.168.*" OR process.command_line : "*100.64.*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Datei-Hashes (1)

  • 16528aadaa45d7bc6718b07ccf8b01f3eb033ad1

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen