{"id":"CVE-2026-43582","aliases":["EUVD-2026-28176","GHSA-w7rc-vvgx-pj45","GHSA-xq94-r468-qwgj"],"status":"published","title":"OpenClaw \u003c 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass","description":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","severity":{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00199,"percentile":0.0976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-350","CWE-367","CWE-918"],"published":"2026-04-17T21:58:01Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"npm","package":"openclaw","fixed_in":["2026.4.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"openclaw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.4.10"}]}]},{"source":"osv","ecosystem":"npm","package":"openclaw","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.4.10"}]}]}],"products":[{"vendor":"openclaw","product":"openclaw"}],"references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xq94-r468-qwgj","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/openclaw/openclaw/commit/121c452d666d4749744dc2089287d0227aae2ed3","tags":["patch","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/openclaw-dns-rebinding-ssrf-via-hostname-validation-bypass","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43582","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w7rc-vvgx-pj45"},{"url":"https://github.com/openclaw/openclaw/pull/64367","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xq94-r468-qwgj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43582.json","tags":["advisory"]},{"url":"https://github.com/openclaw/openclaw","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-43582","title":"OpenClaw \u003c 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass","description":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","status":"published","published":"2026-05-06T19:49:24.759Z","modified":"2026-05-07T12:32:09.498Z","cvss":[{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-28176","description":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","status":"published","published":"2026-05-06T19:49:24Z","modified":"2026-05-07T12:32:09Z","cvss":[{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:05:15.366699Z"}],"ghsa":[{"id":"GHSA-w7rc-vvgx-pj45","title":"Duplicate Advisory: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xq94-r468-qwgj. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","status":"withdrawn","published":"2026-05-06T21:31:42Z","modified":"2026-05-11T16:15:00Z","cvss":[{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-xq94-r468-qwgj","title":"OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding","description":"## Summary\n\nBrowser SSRF hostname validation could be bypassed by DNS rebinding.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.10`\n- Patched versions: `\u003e= 2026.4.10`\n\n## Impact\n\nBrowser navigation policy could validate a hostname/IP resolution that differed from the address Chromium ultimately used, allowing DNS rebinding style SSRF pivots.\n\n## Technical Details\n\nThe fix tightens strict browser hostname navigation so unallowlisted hostname URLs fail closed under restrictive policy.\n\n## Fix\n\nThe issue was fixed in #64367. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `121c452d666d4749744dc2089287d0227aae2ed3`\n- PR: #64367\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.","status":"published","published":"2026-04-17T21:58:01Z","modified":"2026-05-12T13:35:05Z","cvss":[{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-350","CWE-918"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-43582","description":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","status":"published","published":"2026-05-06T20:16:34.05Z","modified":"2026-06-17T10:49:54.437Z","cvss":[{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T14:12:17.418622Z"}],"osv":[{"id":"CVE-2026-43582","title":"OpenClaw \u003c 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass","description":"OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","status":"published","published":"2026-05-06T19:49:24.759Z","modified":"2026-10-28T02:30:30.330784593Z","cvss":[{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-w7rc-vvgx-pj45","title":"Duplicate Advisory: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xq94-r468-qwgj. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.","status":"withdrawn","published":"2026-05-06T21:31:42Z","modified":"2026-05-11T16:37:27.620937Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"GHSA-xq94-r468-qwgj","title":"OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding","description":"## Summary\n\nBrowser SSRF hostname validation could be bypassed by DNS rebinding.\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Ecosystem: npm\n- Affected versions: `\u003c 2026.4.10`\n- Patched versions: `\u003e= 2026.4.10`\n\n## Impact\n\nBrowser navigation policy could validate a hostname/IP resolution that differed from the address Chromium ultimately used, allowing DNS rebinding style SSRF pivots.\n\n## Technical Details\n\nThe fix tightens strict browser hostname navigation so unallowlisted hostname URLs fail closed under restrictive policy.\n\n## Fix\n\nThe issue was fixed in #64367. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.\n\n## Fix Commit(s)\n\n- `121c452d666d4749744dc2089287d0227aae2ed3`\n- PR: #64367\n\n## Release Process Note\n\nUsers should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.\n\n## Credits\n\nThanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.","status":"published","published":"2026-04-17T21:58:01Z","modified":"2026-05-12T17:11:27.098474Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":4.9,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","level":"medium"}],"cwes":["CWE-350","CWE-918"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}