CVE-2026-43580: OpenClaw SSRF Vulnerability

CVE-2026-43580 Overview

CVE-2026-43580 is an incomplete authorization vulnerability [CWE-862] in OpenClaw versions prior to 2026.4.10. The flaw stems from missing Server-Side Request Forgery (SSRF) policy enforcement in the navigation guard logic. Browser-style interactions, including pressKey and type submit flows, can bypass post-action security checks and trigger unauthorized navigation. An attacker with low privileges can exploit this weakness over the network without user interaction, impacting downstream subsystems that trust the navigation guard's policy decisions.

Critical Impact
Attackers can bypass SSRF policy enforcement to execute unauthorized navigation through browser interaction primitives, exposing connected systems to attacker-controlled destinations.

Affected Products

OpenClaw versions prior to 2026.4.10
Browser interaction subsystem (pressKey flow)
Browser interaction subsystem (type submit flow)

Discovery Timeline

2026-05-06 - CVE-2026-43580 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43580

Vulnerability Analysis

The vulnerability resides in OpenClaw's navigation guard, the component responsible for enforcing SSRF policy decisions before navigation occurs. The guard performs validation on direct navigation calls but does not consistently apply the same checks to navigation triggered indirectly through browser-style input primitives. Specifically, the pressKey interaction and type submit flow can cause navigation as a side effect of user-input simulation, and these paths reach the navigation engine after the SSRF policy gate has already been evaluated or skipped entirely.

The missing authorization condition allows a low-privileged caller to issue input simulation commands that resolve into navigation events targeting destinations the SSRF policy would otherwise block. This includes internal endpoints, cloud metadata services, or other restricted network resources reachable from the OpenClaw runtime.

Root Cause

The root cause is incomplete coverage of the navigation guard. SSRF policy enforcement is gated on a subset of navigation entry points rather than centralized at the navigation engine. Browser interaction primitives that produce navigation as a derived behavior fall outside this gate, leaving the post-action security check ineffective for those code paths.

Attack Vector

An attacker with API access invokes browser interaction primitives such as pressKey or type against form elements that trigger submission. The resulting navigation reaches the underlying browser engine without re-evaluation against the SSRF allowlist. The vulnerability mechanism is described in the VulnCheck Security Advisory and the GitHub Security Advisory GHSA-536q-mj95-h29h. No verified public exploit code is available at the time of publication.

Detection Methods for CVE-2026-43580

Indicators of Compromise

Outbound navigation requests from the OpenClaw runtime to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local metadata endpoints such as 169.254.169.254.
API call sequences that combine pressKey or type submit primitives with form targets pointing to non-allowlisted URLs.
Navigation events in OpenClaw logs that lack a corresponding SSRF policy evaluation entry.

Detection Strategies

Correlate browser interaction API calls against subsequent navigation events and flag cases where the navigation destination was not validated against the SSRF policy.
Inspect OpenClaw audit logs for pressKey and type invocations preceding cross-origin or internal-network navigation.
Compare destination URLs in navigation telemetry against the configured SSRF allowlist to identify policy bypasses.

Monitoring Recommendations

Forward OpenClaw runtime logs to a centralized SIEM and alert on navigation to RFC1918 ranges, cloud metadata endpoints, and loopback addresses.
Track network egress from hosts running OpenClaw to detect unexpected destinations following automation runs.
Monitor process and container telemetry for OpenClaw versions older than 2026.4.10.

How to Mitigate CVE-2026-43580

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.10 or later, which contains the navigation guard fix.
Inventory all hosts and containers running OpenClaw and prioritize patching for instances exposed to untrusted automation input.
Restrict network egress from OpenClaw runtimes to only the destinations required for legitimate workflows.

Patch Information

The fix is delivered through three commits referenced in the project repository: commit 049acf2, commit 5f5b3d7, and commit e0b8ddc. Coordinated remediation guidance is published in the GitHub Security Advisory GHSA-536q-mj95-h29h.

Workarounds

Place OpenClaw behind an egress proxy that enforces an allowlist of permitted destinations independent of the application's internal SSRF policy.
Disable or restrict access to the pressKey and type browser interaction primitives in deployments where they are not required.
Run OpenClaw in network-isolated segments that cannot reach internal services or cloud metadata endpoints.

bash

# Configuration example: enforce egress allowlist via iptables
iptables -A OUTPUT -m owner --uid-owner openclaw -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openclaw -d 192.168.0.0/16 -j REJECT