CVE-2026-43580CWE-862

OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions

Medium · published May 6, 2026

CVSS v4.0
4.9
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

The record
Technical detail
CVSS v4.0
4.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions
    cvelistv5