GitHub Advisoryadvisory · npm

GHSA-xq94-r468-qwgj OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

MEDIUM Published 2026-04-17 Modified 2026-05-12 Official page ↗
Aliases
CVE-2026-43582
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-350, CWE-918
Reviewed
2026-04-17

Affected packages

• npm openclaw: < 2026.4.10 → fixed in 2026.4.10

Description

Summary Browser SSRF hostname validation could be bypassed by DNS rebinding. Affected Packages / Versions • Package: `openclaw` • Ecosystem: npm • Affected versions: `= 2026.4.10` Impact Browser navigation policy could validate a hostname/IP resolution that differed from the address Chromium ultimately used, allowing DNS rebinding style SSRF pivots. Technical Details The fix tightens strict browser hostname navigation so unallowlisted hostname URLs fail closed under restrictive policy. Fix The issue was fixed in #64367. The first stable tag containing the fix is `v2026.4.10`, and `[email protected]` includes the fix. Fix Commit(s) • `121c452d666d4749744dc2089287d0227aae2ed3` • PR: #64367 Release Process Note Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix. Credits Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-43582 OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass… vulnerability

Weakness · CWE (2)

  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness
  • CWE-918 Server-Side Request Forgery weakness

References