CVE-2026-43577
Path Traversal in OpenClaw via CDP Origin Bypass
Publication date: 2026-05-06
Last updated on: 2026-05-07
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions before 2026.4.9 and involves a file read flaw. It allows attackers to bypass navigation guards by exploiting browser act/evaluate interactions. Through this, attackers can access the local CDP origin and create or read file:// pages that should be restricted by direct navigation policies.
How can this vulnerability impact me? :
The vulnerability can allow attackers to read or create local files that are normally protected by navigation restrictions. This could lead to unauthorized access to sensitive local data or manipulation of local files, potentially compromising the security and privacy of the affected system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade OpenClaw to version 2026.4.9 or later, such as [email protected], where the issue has been fixed.
The fix involves re-checking browser URLs after interaction-driven navigations to block targets violating navigation policies, preventing unauthorized file access.
Users are advised to apply this update promptly to reduce the risk of attackers bypassing navigation guards and accessing disallowed file:// pages.