OpenClaw CVE-2026-43581

Exploitation requires the OpenClaw sandbox browser feature to be actively running with default (vulnerable) configuration in versions before 2026.4.10. The attacker must have adjacent network access to the Docker bridge network where the sandbox browser container is deployed - typically achieved by controlling a peer container in the same Docker Compose stack, Kubernetes pod network, or local area network with bridge access. The CDP relay must be started (default behavior when sandbox browser is initialized). Exploitation is NOT possible from the public internet (AV:A limits to adjacent networks), does NOT require authentication to OpenClaw itself (PR:N), and does NOT require user interaction (UI:N). Docker network isolation (user-defined bridge with --internal flag or network policies blocking inter-container traffic) and non-default cdpSourceRange configuration limit exposure.

CVSS 9.0 (AV:A/AC:L/PR:N/UI:N) indicates adjacent network exploitation with low complexity and no authentication, resulting in high impact to confidentiality, integrity, availability, and subsequent system scope. The Adjacent Vector (AV:A) limits exploitation to attackers on the same network segment as the Docker bridge - typically peer containers in the same pod/stack or local network attackers with Docker network access. Attack Complexity Low (AC:L) and Present Attack Requirements (AT:P) reflect that exploitation requires the sandbox browser to be running with default (pre-patch) configuration. No EPSS score or CISA KEV status provided, suggesting limited real-world exploitation visibility at time of analysis. The vulnerability's real-world severity depends heavily on deployment architecture: multi-tenant container environments where untrusted workloads share Docker networks face critical risk, while single-tenant or network-isolated deployments have reduced exposure. The comprehensive fix with fail-closed defaults and unit test coverage indicates vendor confidence in remediation completeness. Primary risk is to AI agent platforms, browser automation frameworks, and testing infrastructure using OpenClaw in shared Docker environments.

An attacker deploys a malicious container on the same Docker bridge network as an OpenClaw sandbox browser instance. The attacker scans the bridge subnet (e.g., 172.21.0.0/16) and discovers the CDP relay listening on port 9222 with 0.0.0.0 binding. Using a standard CDP client library, the attacker connects to the exposed endpoint and issues Chrome DevTools Protocol commands to navigate sandboxed browser sessions, inject JavaScript into agent-controlled pages, exfiltrate cookies/tokens from browser storage, or manipulate DOM content to poison agent training data.