Server-Side Request Forgery in OpenClaw Affects Internal Resource Security

CVE-2026-43582

What is CVE-2026-43582?

OpenClaw, prior to version 2026.4.10, is vulnerable to a server-side request forgery (SSRF) due to inadequate hostname validation in its browser navigation policy. This flaw enables attackers to exploit DNS rebinding attacks, resulting in inconsistent hostname resolution during validation and actual network requests. By leveraging this vulnerability, attackers can gain unauthorized access to internal resources through unallowed hostname URLs, potentially leading to further exposure or exploitation of sensitive data.

References