GHSA-3X84-QQ85-FJ65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not...

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not...

npm: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

npm: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs vulnerability discovered by ? in WordPress npm openclaw versions 2026.6.6...

Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3x84-qq85-fj65. This link is maintained to preserve external references. Original Description OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSock...

CVE-2026-62197

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled...

PT-2026-57899

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.6.6 Description A policy bypass exists in the browser CDP Chrome DevTools Protocol discovery feature. This issue allows the system to accept blocked WebSocket URLs, enabling attackers with lower-trust access to...