●PocketClawAI security alerts
Sign in
highCVSS 8.1NVD status: Analyzed

CVE-2026-28458

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing...

ComponentOpenClaw
Severityhigh (CVSS 8.1)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published (NVD)2026-03-05
Last modified2026-06-17
Affected versions
openclaw >= 2026.1.20, < 2026.2.1
Fixed in2026.2.1
WeaknessCWE-306
CISA KEVnot listed

NVD description

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.

Does CVE-2026-28458 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for OpenClaw.
Check my stack

What to do

  • Upgrade OpenClaw to 2026.2.1 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other OpenClaw CVEs

medium
CVE-2026-108757CVSS 6.5

Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips...

OpenClaw
2026-10-11high
CVE-2026-101884CVSS 7.5

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*,...

OpenClaw
2026-09-30high
CVE-2026-101880CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShe...

OpenClaw
2026-09-30medium
CVE-2026-101881CVSS 6.5

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport th...

OpenClaw
2026-09-30medium
CVE-2026-101883CVSS 5.4

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses U...

OpenClaw
2026-09-30high
CVE-2026-101882CVSS 8.8

OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-exec...

OpenClaw
2026-09-30

All OpenClaw CVEs