PT-2026-23535 · Moltbot+1 · Moltbot+1

Johnatzeropath + 1 · Published 2026-02-17 · Updated 2026-03-18 · CVE-2026-28458

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.20 through 2026.2.0 moltbot versions 0.1.0 and earlier

Description The Browser Relay /cdp WebSocket endpoint did not require authentication, allowing websites to connect via loopback and access sensitive data. Attackers can connect to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs. Users must have the Browser Relay extension installed and active, and must visit an untrusted site for exploitation to occur. The vulnerable component exposes a local WebSocket endpoint for forwarding Chrome DevTools Protocol (CDP) messages. The /cdp upgrade path verified the TCP peer was loopback but did not require a shared secret and did not block browser-initiated cross-origin requests.

Recommendations Update to OpenClaw version 2026.2.1 or later. If you cannot update immediately, disable the Browser Relay extension or relay server and avoid visiting untrusted sites.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-28458

GHSA-MR32-VWC2-5J6H

Affected Products

Openclaw

Moltbot

References · 11

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mr32-vwc2-5j6h · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28458 · Security Note
• https://osv.dev/vulnerability/GHSA-mr32-vwc2-5j6h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28458 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.1 · Note
• https://twitter.com/rwsanders/status/2034301118663241840 · Twitter Post
• https://vulncheck.com/advisories/openclaw-missing-authentication-in-browser-relay-cdp-websocket-endpoint · Note
• https://twitter.com/TheHackerWire/status/2030252370517717180 · Twitter Post
• https://twitter.com/CVEnew/status/2030385187062706652 · Twitter Post