CVE-2026-43580 in OpenClaw
Summary
by MITRE • 05/06/2026
OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/09/2026
The OpenClaw vulnerability identified in versions prior to 2026.4.10 represents a critical security flaw that undermines the integrity of the application's navigation control mechanisms. This vulnerability manifests as an incomplete navigation guard that fails to properly enforce server-side request forgery (SSRF) policies during user interaction sequences. The flaw exists within the browser's press and type interaction handling systems, specifically affecting how the application processes keyboard events and form submissions. Attackers can exploit this weakness by leveraging legitimate browser interaction patterns such as pressKey and type submit flows to bypass the intended security controls that should prevent unauthorized navigation attempts.
The technical implementation of this vulnerability stems from insufficient validation within the application's navigation processing pipeline. When users interact with web forms through keyboard presses or text input operations, the system should enforce strict SSRF policy checks before allowing any navigation to occur. However, the incomplete guard mechanism allows certain interaction sequences to proceed without proper authorization verification, creating a pathway for malicious actors to redirect application flow to unintended destinations. This issue particularly affects the post-action security validation processes that should occur after user input events, where the system fails to properly validate the legitimacy of navigation targets even after legitimate interaction patterns have been processed.
The operational impact of this vulnerability extends beyond simple unauthorized navigation, as it provides attackers with a potential means to execute arbitrary code or redirect users to malicious sites. The vulnerability's exploitation requires minimal privileges and can be achieved through standard browser interaction patterns, making it particularly dangerous in environments where users have varying levels of access rights. Security controls designed to prevent SSRF attacks are effectively circumvented, potentially allowing attackers to access internal network resources or manipulate application behavior in ways that were not intended by the system's design. The flaw creates a persistent risk that can be exploited repeatedly, as the navigation guard mechanism remains incomplete regardless of how many times the vulnerable interaction patterns are used.
Mitigation strategies should focus on implementing comprehensive navigation validation that occurs regardless of interaction type or sequence. Organizations should ensure that all browser interaction patterns, including keyboard events and form submissions, undergo strict SSRF policy enforcement before any navigation is permitted. The system should implement a robust validation framework that checks the legitimacy of target URLs and navigation destinations against a comprehensive whitelist or secure policy baseline. Security patches should address the root cause by strengthening the post-action validation mechanisms and ensuring that all user interaction events trigger complete security checks before navigation processing begins. Additionally, implementing proper input sanitization and URL validation routines can help prevent exploitation of similar vulnerabilities in related components. This vulnerability aligns with CWE-601 and ATT&CK techniques focusing on URL redirection and server-side request forgery attacks, emphasizing the need for comprehensive security controls in web application frameworks.