PT-2026-38236 · Openclaw · Openclaw

R1Kko1337 · Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-43581

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description An improper network binding issue exists in the sandbox browser CDP relay, which exposes the Chrome DevTools Protocol on 0.0.0.0. This overly broad binding configuration allows attackers to access the DevTools protocol from outside the intended local sandbox boundaries.

Recommendations Update to version 2026.4.10.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-43581

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-525j-hqq2-66r4 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/fbf11ebdb7110632f93926d0ac7b48f04cb44d77 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43581 · Security Note
• https://twitter.com/CVEnew/status/2052430116567838762 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054777765388275869 · Twitter Post
• https://vulncheck.com/advisories/openclaw-chrome-devtools-protocol-exposure-via-overly-broad-cdp-relay-binding · Note
• https://twitter.com/VulmonFeeds/status/2052164086381633636 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2052245139209253372 · Twitter Post