Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Browser extension relay, which reserves entries in a single global pending-authentication pool before a client proves possessi...

CVE-2026-100527

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

CVE-2026-100527 OpenClaw before 2026.8.2 Denial of Service via Browser Relay

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

CVE-2026-100527 OpenClaw before 2026.8.2 Denial of Service via Browser Relay

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

EUVD-2026-87523

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

CVE-2026-100527

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

CVE-2026-100527

Versions of OpenClaw prior to 2026.8.2 are vulnerable to a denial of service (DoS) flaw within the Browser extension relay . This issue allows unauthenticated network sources to exhaust pending-authentication capacity by maintaining silent WebSocket upgrades . By occupying every available pending...

PT-2026-99164

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.2 Description A denial of service issue exists in the Browser extension relay. Unauthenticated network sources can exhaust the pending-authentication capacity by maintaining silent WebSocket upgrades. This...

CVE-2026-100527: Uncontrolled Resource Consumption

OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions...

OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

Summary When the optional Chrome extension relay is enabled, /extension accepted unauthenticated WebSocket upgrades while /json/ and /cdp required auth. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.17 - Latest published npm version at triage time: 2026.2.17 Impact Thi...

PT-2026-25477

Summary When the optional Chrome extension relay is enabled, /extension accepted unauthenticated WebSocket upgrades while /json/ and /cdp required auth. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.17 - Latest published npm version at triage time: 2026.2.17 Impact Thi...

GHSA-QW99-GRCX-4PVM OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback

Summary The Chrome extension relay ensureChromeExtensionRelayServer previously treated wildcard hosts 0.0.0.0 / :: as loopback, which could make it bind the relay HTTP/WS server to all interfaces when a wildcard cdpUrl was passed. Impact If configured with a wildcard cdpUrl, relay HTTP endpoints...

Binding to an Unrestricted IP Address

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address via ensureChromeExtensionRelayServer. An attacker can access relay HTTP endpoints from off-host locations by passing a wildcard cdpUrl, potentially...

Malicious code in chrome-extension-message-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422f9abdd9d35628def10118ea6412b99c816f1ec94c49b3596d5fb8feef5d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...