Every CVE Search/ Get API key

CVE-2026-43573

OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes

4.9 MediumFix available

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.25%Up 0.2 points since May 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.9

OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

Record
CVE-2026-43573
CVSS 4.0
4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-862, CWE-918
Updated
2026-11-02
EUVDEUVD-2026-27297 4.9

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

Record
EUVD-2026-27297
CVSS 4.0
4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-527m-976r-jf79 6.3

OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

Summary

Existing-session browser interaction routes bypassed SSRF policy enforcement.

Affected Packages / Versions

  • Package: openclaw
  • Ecosystem: npm
  • Affected versions: < 2026.4.10
  • Patched versions: >= 2026.4.10

Impact

Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.

Technical Details

The fix guards existing-session navigation and interaction routes with browser navigation policy checks.

Fix

The issue was fixed in #64370. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

  • daeb74920d5ad986cb600625180037e23221e93a
  • PR: #64370

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Record
GHSA-527m-976r-jf79
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-862, CWE-918
Updated
2026-11-02
NVD 4.9

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

Record
CVE-2026-43573
CVSS 4.0
4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-862, CWE-918
Updated
2026-11-02
OSV 4.9

OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

Record
CVE-2026-43573
CVSS 4.0
4.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-862, CWE-918
Updated
2026-11-02
OSVGHSA-527m-976r-jf79 6.3

OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

Summary

Existing-session browser interaction routes bypassed SSRF policy enforcement.

Affected Packages / Versions

  • Package: openclaw
  • Ecosystem: npm
  • Affected versions: < 2026.4.10
  • Patched versions: >= 2026.4.10

Impact

Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes.

Technical Details

The fix guards existing-session navigation and interaction routes with browser navigation policy checks.

Fix

The issue was fixed in #64370. The first stable tag containing the fix is v2026.4.10, and [email protected] includes the fix.

Fix Commit(s)

  • daeb74920d5ad986cb600625180037e23221e93a
  • PR: #64370

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Record
GHSA-527m-976r-jf79
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-862, CWE-918
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openclaw
npm
 before 2026.4.10
2026.4.10

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-43573 is a medium vulnerability (CVSS 4.9) in Openclaw, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in openclaw 2026.4.10.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open