Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-43581: OpenClaw before 2026.4.10 allows unauthorized access to Chrome DevTools

CVE-2026-43581 · published 6 months ago

Summary

OpenClaw, a software used for browser automation, has a security flaw that allows attackers to access internal tools and data. This can happen if an attacker is on the same network as the OpenClaw system. To fix this, update OpenClaw to version 2026.4.10 or later.

What to do

Update openclaw openclaw to version 2026.4.10 or later.

Affected software

Vendor	Product	Affected versions
openclaw	openclaw	< 2026.4.10 `cpe:2.3:a:openclaw:openclaw::::::node.js::*`

Original advisory text

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

References

https://github.com/openclaw/openclaw/commit/fbf11ebdb7110632f93926d0ac7b48f04cb4... Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-525j-hqq2-66r4 Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-chrome-devtools-protocol-exposure-... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.0 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-1188Initialization of a Resource with an Insecure Default

Timeline

Published6 May 2026

Updated29 Oct 2026

First seen7 May 2026

Sources

CVE-2026-43581 · NVD

Track software like this

Free during beta