{"action":"Upgrade openclaw to 2026.4.14 or later.","affected":[{"fixed":"2026.4.14","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-43527"],"ecosystem":"npm","epss":0.0028,"exploited":false,"fixed_versions":["2026.4.14"],"ghsa_id":"GHSA-53vx-pmqw-863c","id":"tcs_01M5KF2EAJQD8H2TGFEGZ2JT9J","modified_at":"2026-05-08T01:49:12.498990Z","published_at":"2026-04-17T21:58:15Z","references":["https://osv.dev/vulnerability/GHSA-53vx-pmqw-863c","https://github.com/openclaw/openclaw/security/advisories/GHSA-53vx-pmqw-863c","https://nvd.nist.gov/vuln/detail/CVE-2026-43527","https://github.com/openclaw/openclaw/pull/66354","https://github.com/openclaw/openclaw/pull/66386","https://github.com/openclaw/openclaw/commit/024f4614a1a1831406e763adc40ef226e3d5e9ed","https://github.com/openclaw/openclaw/commit/1dabfef28db523e7de81edeb3dd689e9171236a2","https://github.com/openclaw/openclaw/commit/213c36cf51121ef6c05cfccd78037371f968f31a","https://github.com/openclaw/openclaw/commit/7eecfa411df3d12e6b810e6ca5df47254fc3db3f","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-private-network-navigation"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-53vx-pmqw-863c","url":"https://osv.dev/vulnerability/GHSA-53vx-pmqw-863c"}],"summary":"OpenClaw: Browser SSRF policy default allowed private-network navigation"}