CVE-2026-43573: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-43573 is a Server-Side Request Forgery (SSRF) policy bypass vulnerability in OpenClaw, an npm-distributed browser automation framework. Existing-session browser interaction routes (click, type, press, evaluate) failed to apply the same SSRF navigation guard enforced by other guarded browser routes, allowing authenticated attackers to interact with or navigate to unauthorized internal targets. All versions of OpenClaw before 2026.4.10 are affected. The vulnerability was published on May 5, 2026, and carries a CVSS v3.1 base score of 7.7 (High) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory).

The root cause is a Missing Authorization / SSRF flaw (CWE-862, CWE-918): existing-session Chrome MCP interaction routes (click, type, press, evaluate) did not invoke the assertBrowserNavigationResultAllowed post-check after actions that could trigger delayed JavaScript redirects. This meant that if an interaction caused the browser to navigate to a restricted internal URL (e.g., http://169.254.169.254/latest/meta-data/), the navigation guard was never consulted and the request proceeded without policy enforcement. The fix, applied in PR #64370, adds a multi-phase polling guard that repeatedly probes the current page URL after each interaction and validates it against the configured SSRF policy, failing closed if a stable, allowed URL cannot be confirmed (GitHub Advisory, Fix Commit).

An authenticated, low-privileged network attacker can exploit this vulnerability to bypass SSRF policy enforcement and cause the OpenClaw server to interact with or navigate to unauthorized internal resources — such as cloud metadata endpoints, internal APIs, or private network services — that would otherwise be blocked. The primary impact is high confidentiality loss against systems reachable from the OpenClaw server (e.g., AWS/GCP/Azure instance metadata, internal HTTP services), with no direct integrity or availability impact. This could facilitate credential theft, internal reconnaissance, or lateral movement depending on what internal services are accessible (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.027%, reflecting low near-term exploitation probability. The vulnerability requires low privileges (an authenticated session) and no user interaction, but does require specific attack conditions (access to an OpenClaw instance with an SSRF policy configured). The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by @zsxsoft with sponsorship from @KeenSecurityLab and @qclawer (GitHub Advisory).

1. Reconnaissance: Identify an accessible OpenClaw instance (npm package openclaw) running a version prior to 2026.4.10 with an SSRF policy configured that restricts access to internal/private network resources.
2. Authenticate: Obtain valid credentials or a session token for the OpenClaw instance, as the vulnerability requires low-privilege authenticated access.
3. Trigger an existing-session interaction: Send a request to an existing-session browser interaction route (e.g., /act with kind: "click", kind: "evaluate", kind: "type" with submit: true, or kind: "press") targeting a browser tab that can be manipulated to navigate to a restricted internal URL.
4. Induce delayed navigation: Craft the interaction (e.g., a JavaScript evaluate payload or a click on a link) so that it triggers a delayed redirect to a restricted internal target such as http://169.254.169.254/latest/meta-data/ (cloud metadata) or another internal service, exploiting the fact that the post-interaction navigation guard is not applied.
5. Access unauthorized resource: Because the SSRF navigation guard is bypassed, the browser session navigates to the restricted target and the attacker can retrieve sensitive data (e.g., cloud credentials, internal API responses) from the resulting page content returned by the OpenClaw server (GitHub Advisory, Fix Commit).

• Network: Outbound HTTP requests from the OpenClaw server process to internal/private IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints following browser interaction API calls.
• Logs: OpenClaw server access logs showing repeated POST requests to /act endpoints with kind values of click, evaluate, type, or press from a single authenticated user, particularly if followed by navigation to non-public URLs.
• Application Behavior: Browser sessions in OpenClaw navigating to unexpected internal URLs or cloud metadata services (e.g., http://169.254.169.254/) after interaction commands, observable in browser session logs or network traffic captures.

Upgrade OpenClaw to version 2026.4.10 or later (the latest npm release, openclaw@2026.4.14, also includes the fix) (GitHub Advisory, Fix Commit). As a network-level workaround, implement egress firewall rules on the host running OpenClaw to block outbound connections to internal/private IP ranges and cloud metadata endpoints (e.g., 169.254.169.254). Additionally, monitor OpenClaw server logs for suspicious SSRF-like activity in existing-session browser interaction routes until the patch can be applied.

The vulnerability was reported by security researcher @zsxsoft with sponsorship from Keen Security Lab (@KeenSecurityLab) and @qclawer, indicating coordinated responsible disclosure (GitHub Advisory). The advisory was published by maintainer @steipete on April 16, 2026. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability aggregator coverage.