CVE-2026-22174

OpenClaw: Affected software is OpenClaw versions prior to 2026.2.22. The root cause is that the x-OpenClaw-relay-token header is injected into Chrome CDP probe traffic on loopback interfaces, enabling local processes to capture the Gateway authentication token. An attacker controlling a loopback ...