Is there a patch available for CVE-2026-43576?

Yes, a patch is available for CVE-2026-43576. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-43576

Q: What is the CVSS score of CVE-2026-43576?

CVE-2026-43576 has a CVSS 4.0 base score of 4.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28164 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-05-06 disclosure@vulncheck.com

SSRF Open Redirect

4.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 21:03 EUVD

Source Code Evidence Fetched

May 06, 2026 - 20:36 vuln.today

Analysis Generated

May 06, 2026 - 20:36 vuln.today

CVE Published

May 06, 2026 - 20:16 nvd

MEDIUM 4.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.5.

DescriptionCVE.org

OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not properly validated, enabling attackers to redirect connections to arbitrary hosts and perform SSRF-style attacks.

AnalysisAI

Server-side request forgery via unvalidated WebSocket URL in OpenClaw before 2026.4.5 allows authenticated attackers to pivot connections to arbitrary hosts through the Chrome DevTools Protocol (CDP) /json/version endpoint. The webSocketDebuggerUrl response field lacks validation, enabling second-hop SSRF attacks where an attacker can redirect browser profile connections to untrusted targets on internal or external networks. No public exploit code identified at time of analysis, but the vulnerability is straightforward to trigger once authenticated to the CDP endpoint.

Technical ContextAI

OpenClaw is a browser automation framework that uses Chrome DevTools Protocol (CDP) to control browser instances. The vulnerability exists in the CDP endpoint handler at /json/version, which returns a webSocketDebuggerUrl field. This field is parsed and used to establish WebSocket connections to the debugging interface. The root cause (CWE-601: URL Redirection to Untrusted Site) stems from insufficient validation of the webSocketDebuggerUrl value before the client application attempts to connect. The attacker can craft a malicious CDP response containing a webSocketDebuggerUrl pointing to an internal IP address (e.g., 169.254.169.254 AWS metadata endpoint or 127.0.0.1 internal services) or external attacker-controlled host. The fix implements endpoint validation using a strict SSRF policy that compares both the initial CDP URL and any discovered secondary endpoints against a whitelist of allowed hostnames, blocking cross-host pivots and direct WebSocket targets to restricted networks.

RemediationAI

Upgrade OpenClaw to version 2026.4.5 or later (recommend 2026.4.14 or newer from npm). For npm users, run 'npm install openclaw@^2026.4.5' to update. The fix is available in commit bc356cc8c2beaa747c71dd86cceab8f804699665 and PR #60469 (https://github.com/openclaw/openclaw/pull/60469). No workarounds are available for older versions; patching is the required remediation. If immediate upgrade is not possible, restrict network access to the CDP endpoint to only trusted, authenticated clients and monitor outbound connections from OpenClaw for unexpected SSRF pivots to internal IPs (169.254.169.254, 127.0.0.1, or private RFC 1918 ranges). See the GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-f7fh-qg34-x2xh for additional details.