Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not properly validated, enabling attackers to redirect connections to arbitrary hosts and perform SSRF-style attacks.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-43576 OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted … https://www.cve.org/CVERecord?id=CVE-2026-43576
Post summary
The post announces that OpenClaw prior to 2026.4.5 has a server‑side request forgery vulnerability in its CDP /json/version WebSocket endpoint, enabling attackers to pivot to untrusted resources.
CVE-2026-43576 Server-Side Request Forgery in OpenClaw Before 2026.4.5 CDP WebSocket Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43576
Post summary
The post briefly announces CVE-2026-43576, describing it as an SSRF flaw in OpenClaw’s WebSocket endpoint, but provides no PoC, exploit code, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |