Cyber Resilience

CVE-2026-43582

Race Condition in Openclaw ≤ 2026.4.10

Public PoCRace Condition
Published
06 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 4.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 10th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-43582 is a medium-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Openclaw Openclaw. Its CVSS base score is 4.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through DNS rebinding attacks. Attackers can exploit inconsistent hostname resolution between validation and actual network requests to pivot to internal…

more

resources via unallowlisted hostname URLs.

CWE(s)
CWE-367

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SSRF vulnerability in a public-facing browser navigation policy directly enables exploitation of public-facing applications to reach internal resources via DNS rebinding.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-32021Same product: Openclaw Openclaw
CVE-2026-41296Same product: Openclaw Openclaw
CVE-2026-43576Same product: Openclaw Openclaw
CVE-2026-35637Same product: Openclaw Openclaw
CVE-2026-35656Same product: Openclaw Openclaw
CVE-2026-41382Same product: Openclaw Openclaw
CVE-2026-62212Same product: Openclaw Openclaw
CVE-2026-32045Same product: Openclaw Openclaw
CVE-2026-32974Same product: Openclaw Openclaw
CVE-2026-31989Same product: Openclaw Openclaw

Affected Assets

openclaw
openclaw
≤ 2026.4.10

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-4 Information Flow Enforcement
  • SC-7 Boundary Protection
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow policies on outbound requests so that hostname-based allow-lists cannot be bypassed to reach internal resources.

SC-7 Boundary Protection good match
prevent

Boundary protection rules can block navigation or requests to internal IP ranges regardless of the hostname presented at validation time.

SI-10 Information Input Validation partial match
prevent

Requires consistent, atomic validation of hostnames (including DNS results) before any network request is performed, directly addressing the TOCTOU flaw.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References