Improper Network Binding Vulnerability in OpenClaw Affects Chrome DevTools Protocol
CVE-2026-43581

9CRITICAL

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
6 May 2026

What is CVE-2026-43581?

The OpenClaw platform prior to version 2026.4.10 suffers from an improper network binding flaw in its sandbox browser CDP relay. This vulnerability allows unauthorized access to the Chrome DevTools Protocol by exposing it on the 0.0.0.0 address. By manipulating the overly permissive binding settings, attackers could bypass the intended local sandbox security measures and gain access to sensitive debug information or control functionalities. It is crucial for users to upgrade to the latest version to mitigate this risk.

Affected Version(s)

OpenClaw 0 < 2026.4.10

OpenClaw 2026.4.10

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/fbf11ebdb7110...
patch
https://www.vulncheck.com/advisories/openclaw-chrome-devt...
third-party-advisory

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

R1kko1337
.