PT-2026-33565 · Npm · Openclaw

Publicado 2026-04-07 · Atualizado 2026-04-07

OSV

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Summary

Before OpenClaw 2026.4.2, remote CDP discovery could return a trailing-dot localhost host such as localhost. and bypass OpenClaw's loopback-host normalization. That let a non-loopback remote CDP profile pivot the follow-up connection back onto localhost.

Impact

A hostile discovery response could retarget authenticated browser control toward a localhost-resolving endpoint on the OpenClaw host. This weakened the existing remote-CDP loopback protection and could expose localhost-backed browser state.

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: <= 2026.4.1
• Patched versions: >= 2026.4.2
• Latest published npm version: 2026.4.1

Fix Commit(s)

• 9c22d636697336a6b22b0ae24798d8b8325d7828 — normalize localhost absolute-form CDP hosts before loopback checks

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @smaeljaish771 for reporting.

Correção

IDOR

RCE

Enumeração de Fraquezas

CWE-639

CWE-20

Identificadores relacionados

GHSA-FH32-73R9-RGH5

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/9c22d636697336a6b22b0ae24798d8b8325d7828 · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fh32-73r9-rgh5 · Nota
• https://vulncheck.com/advisories/openclaw-loopback-protection-bypass-via-trailing-dot-localhost-in-cdp-discovery · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-41372 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fh32-73r9-rgh5 · Aviso do Fabricante