Skip to content
CVSS 7.7 · HIGH

CVE-2026-43580

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

View on NVD

Analysis

OpenClaw is an open-source recreation of a retro game engine, which is not a common component in the professional web or mobile development stacks used by the community. While the SSRF policy bypass is a high-severity issue, the extremely niche nature of this specific software means it does not warrant a broad alert to systems administrators or developers.

Severity

Score: 7.7(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
AV: NETWORK
AC: LOW
PR: LOW
UI: NONE
S: CHANGED
C: HIGH
I: NONE
A: NONE
Weakness (CWE): CWE-862

EPSS

No EPSS score yet (CVE may be too fresh).

Technical description

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

Published: 5/6/2026, 8:16:33 PM
Last modified: 5/6/2026, 9:20:52 PM

References

HomeEventsBlogResourcesTeam