CVE-2026-43582

Katalog CVE

CVSS 6.3 · Medium EPSS 0,31%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada openclaw. Skor CVSS 3.1 6.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal resources via unallowlisted hostname URLs.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-xq94-r468-qwgj mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/121c452d666d4749744dc2089287d0227aae2ed3 patch
• https://www.vulncheck.com/advisories/openclaw-dns-rebinding-ssrf-via-hostname-validation-bypass advisory pihak ketiga