Junglewise Threat Intelligence

CVE-2026-43527: OpenClaw browser SSRF default allowed private-network navigation

CVE-2026-43527 · Severity: low · CVSS 3.1 · Published 2026-04-17

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a browser automation framework that embeds protections against Server-Side Request Forgery (SSRF) attacks. A default security policy configuration inadvertently allowed navigation to private internal networks and metadata endpoints, which could expose internal services when an attacker controls browser navigation. The issue has been patched to enforce strict SSRF defaults while preserving legitimate internal control-plane operations.

Technical details

The vulnerability is a configuration bypass (CWE-1188, CWE-918) in OpenClaw's browser SSRF policy enforcement. The root cause was that the default SSRF policy object (`resolveBrowserSsrFPolicy()` returning `{}`) was intended to enforce fail-closed navigation but instead flowed into CDP (Chrome DevTools Protocol) helper code paths that treated managed loopback interfaces as untrusted private-network targets. An attacker who can control or inject browser navigation requests could bypass SSRF protections to reach internal services on private networks. The fix (released in v2026.4.14) preserves strict SSRF configuration semantics, disables private-network access by default unless explicitly opted in, and properly separates loopback CDP control-plane probes from browser navigation policy. No authentication or user interaction is required; the attack vector is network-based navigation injection.

Affected products

  • OpenClaw openclaw < 2026.4.14

Timeline

  • 2026-04-17: disclosed
  • 2026-04-14: patched

References