Vulnerability · Published Mar 5, 2026 · Assigned by VulnCheck

CVE-2026-28395OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl

Medium 6.5

In plain English

A medium-severity security flaw in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats wildcard hosts as loopback addresses, allowing the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl is configured. Remote attackers can access relay HTTP endpoints off-host to leak service presence and port information, or conduct denial-of-service and brute-force attacks against the relay token header.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	openclaw	2026.2.12	GHSA-qw99-grcx-4pvm

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	2026.1.14-1 – before 2026.2.12

Weakness: CWE-1327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References

GitHub Security Advisory (GHSA-qw99-grcx-4pvm) vendor-advisory
Patch Commit patch
Hardening Commit patch
VulnCheck Advisory: OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl third-party-advisory