Which versions of OpenClaw are affected by CVE-2026-43573?

OpenClaw npm package versions prior to 2026.4.10 contain a server-side request forgery (SSRF) policy bypass that allows authenticated attackers to access unauthorized targets and disclose sensitive…. A patch is available.

How to fix or mitigate CVE-2026-43573?

Within 24 hours: Identify all applications and systems using OpenClaw npm package and document current versions deployed. Within 7 days: Upgrade OpenClaw to version 2026.4.10 or later across all affected environments; test in staging first to ensure compatibility. Within 30 days: Conduct audit of OpenClaw usage logs to detect any unauthorized SSRF traversal attempts; review access controls on systems accessible via OpenClaw automation routes.

OpenClaw CVE-2026-43573

Q: What is the CVSS score of CVE-2026-43573?

CVE-2026-43573 has a CVSS 4.0 base score of 4.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27297 MEDIUM

Missing Authorization (CWE-862)

2026-05-05 VulnCheck

Authentication Bypass SSRF Openclaw

4.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 05, 2026 - 12:37 NVD

HIGH MEDIUM

CVSS changed

May 05, 2026 - 12:37 NVD

7.7 (HIGH) 4.9 (MEDIUM)

Source Code Evidence Fetched

May 05, 2026 - 12:21 vuln.today

Analysis Generated

May 05, 2026 - 12:21 vuln.today

DescriptionCVE.org

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement.

AnalysisAI

Server-side request forgery policy bypass in OpenClaw npm package (versions < 2026.4.10) allows authenticated remote attackers to interact with or navigate to unauthorized targets through existing-session browser interaction routes. The vulnerability bypasses SSRF navigation guards in routes handling click, type, press, and evaluate actions, enabling cross-scope information disclosure. Vendor-released patch available in version 2026.4.10. No public exploit identified at time of analysis, though EPSS data not available. Reported by security researchers from KeenSecurityLab with detailed technical disclosure.

Technical ContextAI

OpenClaw is an npm package providing browser automation capabilities via Chrome MCP (Model Context Protocol) integration. The vulnerability (CWE-862: Missing Authorization) affects existing-session browser interaction routes that handle user actions like clicking elements, typing text, pressing keys, and evaluating JavaScript. The codebase previously applied SSRF navigation guards only to initial browser route access but failed to re-validate navigation policy after delayed navigation events triggered by interaction commands. The technical root cause is the absence of post-action navigation checks in Chrome MCP interaction methods (clickChromeMcpElement, fillChromeMcpElement, pressChromeMcpKey, evaluateChromeMcpScript). When these methods trigger page navigation as a side effect (e.g., clicking a submit button or pressing Enter in a form), the subsequent navigation bypassed the configured SSRF policy enforcement. The fix (commit daeb74920d5ad986cb600625180037e23221e93a, PR #64370) adds assertBrowserNavigationResultAllowed checks after interaction methods complete, ensuring delayed navigation respects the same allowPrivateNetwork policy applied to direct navigation commands.

RemediationAI

Upgrade to OpenClaw version 2026.4.10 or later immediately. The latest stable release 2026.4.14 available via npm includes the fix. Run 'npm update openclaw' or specify 'openclaw@^2026.4.14' in package.json dependencies. The patch (commit daeb74920d5ad986cb600625180037e23221e93a from PR #64370) adds navigation policy enforcement to existing-session Chrome MCP interaction routes-no configuration changes required after upgrade. Vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-527m-976r-jf79 and patch commit at https://github.com/openclaw/openclaw/commit/daeb74920d5ad986cb600625180037e23221e93a provide full technical details. If immediate patching is not feasible, implement compensating controls: (1) Restrict authenticated user access to OpenClaw browser automation endpoints using role-based access controls-reduces attack surface but does not eliminate risk for legitimate users. (2) Deploy OpenClaw in network-isolated environments without access to private network ranges or cloud metadata services-limits SSRF impact but degrades functionality if internal resource access is required. (3) Monitor outbound connections from OpenClaw processes for unexpected private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) or cloud metadata endpoints-provides detection but not prevention. (4) Implement network-level egress filtering to block access to sensitive internal services-effective but may break legitimate automation scenarios. Note that workarounds 2-4 add operational complexity and may conflict with intended use cases. Patching to 2026.4.10+ is the only complete solution with no functional trade-offs.