CVE-2026-90818

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90818
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90818.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90818
Published
2026-09-14T20:15:12Z
Modified
2026-09-18T03:30:32Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery
Details

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90818.json"
}
References

Affected packages

Git / github.com/netease-youdao/lobsterai

Affected ranges

Type
GIT
Repo
https://github.com/netease-youdao/lobsterai
Events
Introduced
5351d1ec650325b6a107a99704a1e5415de9097d
Last Affected
7592cd034a7cb458a8650df0325b4980dd1bc162
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2026.6.15"
        },
        {
            "last_affected": "2026.6.15"
        },
        {
            "introduced": "2026.8.28"
        },
        {
            "last_affected": "2026.8.28"
        },
        {
            "introduced": "2026.9.3"
        },
        {
            "last_affected": "2026.9.3"
        },
        {
            "introduced": "2026.9.4"
        },
        {
            "last_affected": "2026.9.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2026.*
2026.6.15
2026.6.18
2026.6.26
2026.6.29
2026.6.30
2026.7.10
2026.7.15
2026.7.16
2026.7.17
2026.7.23
2026.7.29
2026.7.3
2026.7.7
2026.8.11
2026.8.14
2026.8.18
2026.8.21
2026.8.25
2026.8.26
2026.8.28
2026.8.5
2026.8.7
2026.9.3
2026.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90818.json"