CVE-2026-28395

OpenClaw version 2026.1.14-1 prior to 2026.2.12 contain an improper network binding vulnerability in the Chrome extension must be installed and enabled relay server that treats wildcard hosts as loopback addresses, allowing the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl...

CVE-2026-28395

OpenClaw's Chrome extension relay server (ensureChromeExtensionRelayServer) incorrectly treats wildcard hosts (0.0.0.0/::) as loopback, causing the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl is configured. Affected versions are 2026.1.14-1 through 2026.2.11; fixed in 20...