High severity7.7GHSA Advisory· Published May 5, 2026· Updated May 7, 2026
CVE-2026-43573
CVE-2026-43573
Description
OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.4.10 | 2026.4.10 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/openclaw/openclaw/commit/daeb74920d5ad986cb600625180037e23221e93anvdPatchWEB
- github.com/advisories/GHSA-527m-976r-jf79ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-527m-976r-jf79nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-43573ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-ssrf-policy-bypass-in-existing-session-browser-interaction-routesnvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/pull/64370ghsaWEB
News mentions
0No linked articles in our index yet.