CVE-2026-43580

Katalog CVE

CVSS 7.7 · High EPSS 0,46%

Kerentanan Missing Authorization pada openclaw. Skor CVSS 3.1 7.7 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement. Browser press/type style interactions, including pressKey and type submit flows, can bypass post-action security checks to execute unauthorized navigation.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-536q-mj95-h29h mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/049acf23cb03e1b92f5c71cd99c6ec5f35cc56fe patch
• https://github.com/openclaw/openclaw/commit/5f5b3d733bdd791cb457f838514179e1288b10b3 patch
• https://github.com/openclaw/openclaw/commit/e0b8ddc1a55185aff1cf9e0e095014d2e4f1d894 patch
• https://www.vulncheck.com/advisories/openclaw-incomplete-navigation-guard-coverage-in-browser-interactions advisory pihak ketiga