CVE-2026-43577: OpenClaw Auth Bypass Vulnerability

CVE-2026-43577 Overview

CVE-2026-43577 is a file read vulnerability in OpenClaw versions before 2026.4.9. The flaw allows attackers to bypass navigation guards through browser act and evaluate interaction routes. Attackers pivot into the local Chrome DevTools Protocol (CDP) origin and create or read disallowed file:// pages despite direct navigation policy restrictions. The weakness is categorized under [CWE-862] Missing Authorization. Successful exploitation discloses local file contents from the host running the affected OpenClaw instance.

Critical Impact
Authenticated network attackers can read arbitrary local files by abusing browser interaction routes to bypass navigation guards in OpenClaw before 2026.4.9.

Affected Products

OpenClaw versions before 2026.4.9
Deployments exposing browser act/evaluate interaction routes
Instances permitting local CDP origin pivoting

Discovery Timeline

2026-05-06 - CVE-2026-43577 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43577

Vulnerability Analysis

OpenClaw enforces direct navigation policy restrictions intended to block access to file:// URLs. The browser interaction routes act and evaluate do not honor these navigation guards. An attacker with low privileges issues interaction calls that drive the underlying browser into the local CDP origin context. From that origin, the attacker creates or fetches file:// pages and reads their contents.

The defect is an authorization gap rather than a memory safety issue. The navigation guard logic is enforced on one execution path while parallel interaction routes reach the same browser primitives without re-checking the policy. This pattern aligns with [CWE-862] Missing Authorization.

Root Cause

The root cause is incomplete enforcement of navigation policy across all browser control surfaces. The act and evaluate routes accept operations that the direct navigation handler rejects. Because both routes ultimately reach the CDP-backed browser context, the policy must be enforced at the trust boundary closest to the browser, not only at the navigation entry point.

Attack Vector

The attacker authenticates with low privileges and sends crafted requests to the browser interaction endpoints. The requests instruct the browser to perform act or evaluate operations that pivot into the local CDP origin. From that origin, file:// resources are reachable. The attacker reads sensitive files such as configuration data, credentials, or source code accessible to the OpenClaw process.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-qmwg-qprg-3j38 and the VulnCheck Advisory on OpenClaw for technical details.

Detection Methods for CVE-2026-43577

Indicators of Compromise

Requests to OpenClaw browser interaction endpoints invoking act or evaluate with payloads referencing file:// schemes.
Browser process activity opening local files unrelated to legitimate automation tasks.
Outbound transfers of file contents shortly after authenticated API calls to OpenClaw.

Detection Strategies

Inspect OpenClaw application logs for act and evaluate route calls containing file://, encoded path traversal sequences, or CDP Page.navigate references.
Correlate authenticated API sessions with subsequent local file access by the OpenClaw or headless browser process.
Alert on OpenClaw instances running versions earlier than 2026.4.9 discovered via software inventory queries.

Monitoring Recommendations

Forward OpenClaw access logs and host process telemetry to a centralized analytics platform for behavioral correlation.
Monitor file-read syscalls performed by the OpenClaw process against sensitive paths such as /etc/, ~/.ssh/, and application secret stores.
Track authentication events to OpenClaw and flag low-privilege accounts performing browser interaction calls outside expected workflows.

How to Mitigate CVE-2026-43577

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.9 or later, which contains the fix in commit 5f5b3d733bdd791cb457f838514179e1288b10b3.
Restrict network access to OpenClaw browser interaction endpoints to trusted automation hosts only.
Rotate any secrets, tokens, or credentials reachable from the OpenClaw process filesystem if compromise is suspected.

Patch Information

The maintainers released a fix referenced in the OpenClaw GitHub commit 5f5b3d7 and the GitHub Security Advisory GHSA-qmwg-qprg-3j38. Apply the upgrade to 2026.4.9 to enforce navigation guards consistently across browser interaction routes.

Workarounds

Disable or block the act and evaluate browser interaction routes at a reverse proxy until the patch is applied.
Run OpenClaw as a low-privilege user inside a sandboxed container to limit the files reachable through the bypass.
Require multi-factor authentication for all OpenClaw accounts to raise the bar for the low-privilege precondition required by this vulnerability.

bash

# Configuration example: restrict interaction routes at reverse proxy
location ~ ^/(act|evaluate) {
    deny all;
    return 403;
}