p PatchFirst

CVE-2026-28395

CVE-2026-28395 · OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats wildcard hosts as loopback addresses, allowing the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl is configured. Remote attackers can access relay HTTP endpoints off-host to leak service presence and port information, or conduct denial-of-service and brute-force attacks against the relay token header.

CVSS 6.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 2026.1.14-1, < 2026.2.12: Affected (custom)

    Update to 2026.2.12

  • openclaw npm

    Affected ranges
    • SEMVER: ≥ 2026.1.14-1, < 2026.2.12

    Update to 2026.2.12

Original sources

Check your server →