Openclaw cli: OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding (CVE-2026-43582)

The OpenClaw CLI package (npm ecosystem) had a security vulnerability (CVE-2026-43582) where the browser's server-side request forgery (SSRF) hostname validation could be bypassed by DNS rebinding. This occurred because the hostname or IP resolution validated by the browser navigation policy could differ from the actual address used by Chromium, allowing an attacker to perform SSRF pivots. The fix involved tightening strict browser hostname navigation policies so that URLs with unallowlisted hostnames fail closed under restrictive policies. The vulnerability affects versions >=2026.1.29 and <2026.4.10 and was fixed in version 2026.4.10, with the fix included in [email protected].

An attacker could exploit this vulnerability to bypass hostname validation in browser navigation policies, enabling SSRF attacks through DNS rebinding. This could lead to unauthorized access or interaction with internal or protected network resources. The CVSS score is 6.3 (medium severity), reflecting network attack vector, high complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact but no integrity or availability impact.

Users should upgrade to OpenClaw CLI version 2026.4.10 or later to apply the official fix. Versions 2026.4.10 and above include the patch that tightens hostname validation to prevent DNS rebinding bypass. No additional mitigation steps are required beyond upgrading.