CVE-2026-43582

MediumCVSS 6.3/10Last modified Nov 11, 2026

Description

OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
OpenClaw	OpenClaw	< 2026.4.10

References

https://github.com/openclaw/openclaw/commit/121c452d666d4749744dc2089287d0227aae2ed3Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-xq94-r468-qwgjMitigation, Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-dns-rebinding-ssrf-via-hostname-validation-bypassThird Party Advisory

Timeline

Published: May 6, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-435836.5OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can CVE-2026-435848.8OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows op CVE-2026-435859.8OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef ro CVE-2026-43593.7A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications CVE-2026-435987.7Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent a CVE-2026-43605.3In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts c CVE-2026-436036.9A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.CVE-2026-436068.5Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially pe CVE-2026-43615.0The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `CVE-2026-436167.8Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by cra CVE-2026-436174.8Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforce CVE-2026-436188.1Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not