CVE-2026-43581CWE-1188

OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding

Critical · published May 6, 2026

CVSS v4.0
9.0
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

The record
Technical detail
CVSS v4.0
9.0 · CRITICAL
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00359 · 28.4th percentile
Weakness
CWE-1188 · Initialization of a Resource with an Insecure Default
Published
2026-05-06T19:49Z
EPSS history
Timeline
  • 06 MAY 19:49Z
    OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding
    cvelistv5