CVE-2026-90818mediumCWE-918

CVE-2026-90818: medium-severity vulnerability in netease-youdao LobsterAI

netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery

Published · Updated

Follow this CVE+ Monitor LobsterAI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.5%
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
netease-youdao · LobsterAI
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — netease-youdao LobsterAI

In the same product, most dangerous first.

CVE-2026-18995MEDIUMnetease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosureEPSS 0.5%CVE-2026-108156MEDIUMLobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.jsonEPSS 0.2%CVE-2026-112014MEDIUMLobsterAI before 2026.10.16 Hardcoded Password in Provider API Key ExportEPSS 0.1%