CVE-2026-17458 mf-yang CVE debrief

Who should care

Users of mf-yang openclaw-cn up to 0.2.1, particularly those with affected product deployments, should be aware of this vulnerability and take necessary precautions to protect their systems. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and implement necessary mitigations. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability is caused by a manipulation of the clickViaPlaywright function in src/browser/routes/agent.act.ts, which allows for server-side request forgery. The vulnerability has a CVSS score of 2.1 and a severity of LOW. Affected product deployments should be identified, and owners should review official advisories for further guidance. Users should verify affected product deployments and review official advisories for further information.

Defensive priority

Low priority, as the vulnerability has a low CVSS score and is not known to be actively exploited. However, defenders should still review official advisories for further guidance and implement necessary mitigations.

Recommended defensive actions

• Inventory and verify affected systems
• Apply vendor remediation when available
• Monitor for suspicious activity
• Implement compensating controls
• Exception tracking and retest
• Review official advisories for further guidance
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was reported to the project early through an issue report, but the project has not responded yet. The exploit has been made public and could be used. Limited source detail is available, and defenders should verify affected product deployments and review official advisories for further information. Defenders should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.