Server-Side Request Forgery Vulnerability in OpenClaw by OpenClaw
CVE-2026-43527

6.3MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
5 May 2026

What is CVE-2026-43527?

OpenClaw prior to version 2026.4.14 includes a server-side request forgery (SSRF) vulnerability caused by a misconfigured SSRF policy in the browser. This flaw allows attackers to bypass network restrictions, enabling unauthorized access to internal services or metadata endpoints through browser-driven requests. It emphasizes the importance of securing network access configurations to prevent potential exploitation.

Affected Version(s)

OpenClaw 0 < 2026.4.14

OpenClaw 2026.4.14

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/024f4614a1a18...
patch
https://github.com/openclaw/openclaw/commit/1dabfef28db52...
patch

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dhyabi2
.