GitHub Advisoryadvisory · npm

GHSA-527m-976r-jf79 OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement

MEDIUM Published 2026-04-17 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-43573
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-862, CWE-918
Reviewed
2026-04-17

Affected packages

• npm openclaw: < 2026.4.10 → fixed in 2026.4.10

Description

Summary Existing-session browser interaction routes bypassed SSRF policy enforcement. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `= 2026.4.10` Impact Existing-session browser interaction routes could continue interacting with or navigating targets without applying the same SSRF navigation guard used by guarded browser routes. Technical Details The fix guards existing-session navigation and interaction routes with browser navigation policy checks. Fix The issue was fixed in #64370. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix. Fix Commit(s) • `daeb74920d5ad986cb600625180037e23221e93a` • PR: #64370 Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-43573 OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-918 Server-Side Request Forgery weakness

References