CVE-2026-43576CWE-601CWE-918

OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL

Medium · published May 6, 2026

CVSS v4.0
4.9
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not properly validated, enabling attackers to redirect connections to arbitrary hosts and perform SSRF-style attacks.

The record
Technical detail
CVSS v4.0
4.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00442 · 37.3th percentile
Weaknesses
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect'); CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL
    cvelistv5