Which versions of OpenClaw are affected by CVE-2026-43581?

OpenClaw sandbox browser versions before 2026.4.10 expose Chrome DevTools Protocol without network segmentation, allowing attackers on the same Docker network to remotely control browser instances…. A patch is available.

How to fix or mitigate CVE-2026-43581?

Within 24 hours: Inventory all OpenClaw deployments and document current versions; isolate OpenClaw Docker containers to restricted networks only (disable 0.0.0.0 binding or implement host firewall rules). Within 7 days: Upgrade all instances to OpenClaw v2026.4.10 or later per vendor advisory. Within 30 days: Conduct network segmentation audit to verify no untrusted containers share networks with OpenClaw; implement network policies enforcing ingress restrictions on CDP relay ports.

OpenClaw CVE-2026-43581

Q: What is the CVSS score of CVE-2026-43581?

CVE-2026-43581 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28175 CRITICAL

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-05-06 disclosure@vulncheck.com

Information Disclosure Google Chrome

9.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 06, 2026 - 21:03 EUVD

Source Code Evidence Fetched

May 06, 2026 - 20:34 vuln.today

Analysis Generated

May 06, 2026 - 20:34 vuln.today

CVE Published

May 06, 2026 - 20:16 nvd

CRITICAL 9.0

DescriptionCVE.org

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

AnalysisAI

Chrome DevTools Protocol exposure in OpenClaw sandbox browser allows adjacent network attackers to remotely control sandboxed Chrome instances and access sensitive data. The CDP relay binds to 0.0.0.0 without source IP restrictions in versions before 2026.4.10, enabling attackers on the same Docker network to bypass sandbox isolation and execute arbitrary JavaScript in browser contexts. Vendor-released patch available (v2026.4.10); no public exploit identified at time of analysis. CVSS 9.0 reflects adjacent network attack vector with high confidentiality, integrity, and availability impact across virtual and system scopes.

Technical ContextAI

Chrome DevTools Protocol (CDP) is a remote debugging interface that provides full control over Chrome/Chromium browser instances, including JavaScript execution, DOM manipulation, network interception, and access to cookies/storage. OpenClaw's sandbox browser architecture uses a socat relay to forward CDP connections from the host to the containerized Chrome instance. The vulnerability stems from CWE-1188 (Insecure Default Initialization of Resource) - the relay bound to 0.0.0.0 on all interfaces without IP source filtering. The fix introduces mandatory CDP_SOURCE_RANGE validation: the entrypoint script now refuses to start socat unless an explicit CIDR is provided, auto-deriving it from the Docker bridge network gateway (e.g., 172.21.0.1/32) or using 127.0.0.1/32 for network=none deployments. For non-bridge network drivers (macvlan, ipvlan), the fix requires explicit administrator configuration to prevent accidental exposure. The patch adds comprehensive test coverage for gateway derivation, IPv6 rejection (relay binds IPv4 only), and network driver edge cases.

RemediationAI

Upgrade to OpenClaw 2026.4.10 or later (npm install openclaw@2026.4.14 contains the fix). The patch enforces CDP source range validation by auto-deriving restrictions from the Docker bridge gateway IP (e.g., 172.21.0.1/32) or requiring explicit OPENCLAW_BROWSER_CDP_SOURCE_RANGE configuration. Fix commit fbf11ebdb7110632f93926d0ac7b48f04cb44d77 and PR #61404 available at https://github.com/openclaw/openclaw/commit/fbf11ebdb7110632f93926d0ac7b48f04cb44d77. For deployments unable to upgrade immediately, set OPENCLAW_BROWSER_CDP_SOURCE_RANGE environment variable to a restrictive CIDR (e.g., 127.0.0.1/32 for localhost-only, or the specific management host IP) before starting the sandbox browser container. Note this workaround requires modifying container orchestration configs and will prevent the socat relay from starting if left unset in patched versions. Network-level mitigation: isolate OpenClaw sandbox containers using Docker network segmentation or firewall rules blocking CDP port (default 9222) from untrusted peers; this adds operational complexity and does not address the root cause. No workaround fully replicates the patch's fail-closed design.