Skip to content
CVSS 7.7 · HIGH

CVE-2026-43527

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through browser-driven requests.

Ver en NVD

Análisis

OpenClaw is a specialized tool for browser automation and scraping with limited adoption in the general developer community. While the SSRF vulnerability is High severity (7.7), it is not a core infrastructure component or a widely used framework like Playwright or Selenium.

Severidad

Puntaje: 7.7(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
AV: NETWORK
AC: LOW
PR: LOW
UI: NONE
S: CHANGED
C: HIGH
I: NONE
A: NONE
Tipo de falla (CWE): CWE-918CWE-1188

EPSS

Probabilidad de explotación (próx. 30 días): 0.0003 (0.0%)
Percentil: 9.3%
EPSS: 2026-05-06

Afecta

openclaw:openclaw

Descripción técnica

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through browser-driven requests.

Publicada: 5/5/2026, 12:16:18
Última modificación: 7/5/2026, 1:56:15

Referencias

InicioEventosBlogRecursosEquipo