PT-2026-38237 · Openclaw · Openclaw

Dhyabi2 · Published 2026-04-17 · Updated 2026-05-07 · CVE-2026-43582

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description A server-side request forgery issue exists in the browser navigation policy. This allows attackers to bypass hostname validation using DNS rebinding attacks, which involve exploiting inconsistent hostname resolution between the validation phase and the actual network request. Consequently, attackers can pivot to internal resources by using URLs with hostnames that are not on the allowlist.

Recommendations Update to version 2026.4.10.

Fix

SSRF

Time Of Check To Time Of Use

Weakness Enumeration

CWE-350

CWE-918

CWE-367

Related Identifiers

CVE-2026-43582

GHSA-W7RC-VVGX-PJ45

GHSA-XQ94-R468-QWGJ

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/security/advisories/GHSA-xq94-r468-qwgj · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/121c452d666d4749744dc2089287d0227aae2ed3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43582 · Security Note
• https://osv.dev/vulnerability/GHSA-w7rc-vvgx-pj45 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xq94-r468-qwgj · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/64367 · Note
• https://vulncheck.com/advisories/openclaw-dns-rebinding-ssrf-via-hostname-validation-bypass · Note
• https://twitter.com/VulmonFeeds/status/2052161526560157726 · Twitter Post
• https://twitter.com/CVEnew/status/2052430115598962720 · Twitter Post