Skip to content
CVSS 7.7 · HIGH

CVE-2026-43580

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

Ver en NVD

Análisis

OpenClaw is an open-source recreation of a retro game engine, which is not a common component in the professional web or mobile development stacks used by the community. While the SSRF policy bypass is a high-severity issue, the extremely niche nature of this specific software means it does not warrant a broad alert to systems administrators or developers.

Severidad

Puntaje: 7.7(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
AV: NETWORK
AC: LOW
PR: LOW
UI: NONE
S: CHANGED
C: HIGH
I: NONE
A: NONE
Tipo de falla (CWE): CWE-862

EPSS

Sin puntaje EPSS aún (CVE muy reciente).

Descripción técnica

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

Publicada: 6/5/2026, 20:16:33
Última modificación: 6/5/2026, 21:20:52

Referencias

InicioEventosBlogRecursosEquipo