Input validation error in OpenClaw - #VU126440
Published: April 17, 2026
Vulnerability identifier: #VU126440
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper input validation in browser hostname validation when processing hostname navigation under restrictive policy. A remote attacker can use DNS rebinding to bypass hostname/IP resolution checks to perform server-side request forgery.
The issue occurs because the validated hostname or IP resolution can differ from the address ultimately used by Chromium.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.4.10