CVE-2026-43581
criticalOpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0.
Vendor / product: Openclaw — openclaw
OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.
CVSS
9.6
9.6 (CVSS v3.1)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-05-06 20:16
Modified: 2026-11-11 23:10
NVD status: Analyzed
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:13 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openclaw / openclaw <2026.4.10
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/openclaw/openclaw/commit/fbf11ebdb7110632f93926d0ac7b48f04cb44d77
Patch / mitigation: https://github.com/openclaw/openclaw/security/advisories/GHSA-525j-hqq2-66r4
References
- https://github.com/openclaw/openclaw/commit/fbf11ebdb7110632f93926d0ac7b48f04cb44d77 disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/security/advisories/GHSA-525j-hqq2-66r4 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openclaw-chrome-devtools-protocol-exposure-via-overly... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗