Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-43582 OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation throug… https://www.cve.org/CVERecord?id=CVE-2026-43582
Post summary
OpenClaw versions before 2026.4.10 have a server‑side request forgery flaw in the browser navigation policy that lets attackers bypass hostname validation.
CVE-2026-43582 Server-Side Request Forgery via DNS Rebinding in OpenClaw Before 2026.4.10 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43582
Post summary
CVE-2026-43582 is an SSRF vulnerability caused by DNS rebinding in OpenClaw before version 2026.4.10, detailed on Vulmon, with no PoC, exploit tool, patch, or active exploitation mention.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |