CVE-2026-43576
Published: 06 May 2026
Description
OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not properly validated, enabling attackers to redirect connections to arbitrary hosts…
more
and perform SSRF-style attacks.
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates redirect targets and URLs to ensure they conform to allowed destinations.
Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Detects server-side request forgery through monitoring of unexpected outbound connections.
Security SummaryAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)