PT-2026-35560 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-41372

NVD

CVSS v3.1

5.8

Medium

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41372

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/9c22d636697336a6b22b0ae24798d8b8325d7828 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-fh32-73r9-rgh5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41372 · Security Note
• https://vulncheck.com/advisories/openclaw-loopback-protection-bypass-via-trailing-dot-localhost-in-cdp-discovery · Note