CVE-2026-42439 MEDIUM

CVE-2026-42439: OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes

Vendor Openclaw

Product OpenClaw

Weakness CWE-862 · Missing authorization

Published May 5, 2026

Last update May 5, 2026

View on NVD All CVEs

CVSS base score

4.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

Key dates

02Disclosure timeline

May 5, 2026 CVE published

May 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-42439 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-69093 WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability CVE-2025-10008 Translate WordPress and go Multilingual – Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion CVE-2024-43956 WordPress MemberPress plugin <= 1.11.34 - Broken Access Control vulnerability CVE-2024-9000 Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary CVE-2025-62961 WordPress Sparkle FSE theme <= 1.0.9 - Broken Access Control vulnerability