{"id":"CVE-2026-62197","kind":"vulnerability","aliases":["CVE-2026-62197","GHSA-3x84-qq85-fj65"],"related":[],"title":"OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs","description":"### Summary\n\nBrowser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.\n\nThis advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.\n\n### Impact\n\nWhen the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.\n\n### Patched Versions\n\nThe first stable patched version is `2026.6.6`.\n\n### Mitigations\n\nUpgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.","summary":"OpenClaw's browser CDP discovery accepted WebSocket URLs that its own policy should have blocked. An attacker who can feed lower-trust input into that path can make OpenClaw reach internal network destinations it is meant to refuse.","severity":"high","cvss":8.5,"epss":0.0033400000538676977,"exploited":false,"exploited_at":null,"products":[{"name":"openclaw","fixed":["2026.6.6"],"affected":"< 2026.6.6","ecosystem":"npm"},{"name":"openclaw","fixed":["2026.6.6"],"affected":"< 2026.6.6","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["ai-agents","ai-tooling","cwe-284","cwe-918","mcp","npm","openclaw","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"Run npm ls openclaw to find the installed version; affected if below 2026.6.6.\nCheck whether the browser CDP discovery feature is enabled in your OpenClaw configuration; the sources do not name the exact setting.","fix":"Upgrade the openclaw npm package to 2026.6.6 or later.\nUntil then, restrict the browser feature to trusted operators or disable it when not needed.","status":"open","published_at":"2026-07-13T22:16:51+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:55:32+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-23T20:55:32Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the openclaw npm package to 2026.6.6 or later.\nUntil then, restrict the browser feature to trusted operators or disable it when not needed.","reach":"network","impact":"medium","summary":"OpenClaw's browser CDP discovery accepted WebSocket URLs that its own policy should have blocked. An attacker who can feed lower-trust input into that path can make OpenClaw reach internal network destinations it is meant to refuse.","category":"ai-tooling","who_cares":["openclaw","npm","self-hosted","mcp"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reaches blocked internal network destinations through OpenClaw's browser connection","analyst_note":"Confirm the exact configuration setting that enables browser CDP discovery and the exploitable input path, from the GHSA-3x84-qq85-fj65 advisory page.","how_to_check":"Run npm ls openclaw to find the installed version; affected if below 2026.6.6.\nCheck whether the browser CDP discovery feature is enabled in your OpenClaw configuration; the sources do not name the exact setting.\nunknown","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000551,"input_tokens":3167,"output_tokens":468,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-284':30B '-62197':12A,20A '-918':32B '2026.6.6':203C '3x84':15A 'accept':6A,44B,83C 'advisori':112C 'affect':88C,158C,219C,252C 'agent':25B 'ai':24B,27B 'ai-ag':23B 'ai-tool':26B 'allowlist':148C,239C 'approv':147C 'attack':55B 'auth':151C 'authent':131C 'avoid':241C 'block':7A,53B,84C,107C,173C 'boundari':152C 'browser':2A,41B,79C 'caller':94C 'cdp':3A,42B,80C 'chang':124C 'channel':236C 'configur':96C,120C,184C 'could':5A,82C,99C,165C 'cross':154C 'cve':10A,18A 'cwe':29B,31B 'depend':179C 'destin':72B,102C,168C 'disabl':225C,250C 'discoveri':4A,43B,81C 'enabl':161C 'execut':139C 'featur':118C,159C,220C,253C 'feed':58B 'first':198C 'fj65':17A 'gateway':132C,244C 'general':233C 'ghsa':14A 'ghsa-3x84-qq85-fj65':13A 'harden':234C 'host':38B 'impact':155C,178C 'input':62B,97C,190C 'instal':134C 'intent':137C 'intern':70B 'keep':235C 'list':214C 'local':138C 'lower':60B,92C,188C 'lower-trust':59B,91C,187C 'make':67B 'mcp':33B 'meant':75B 'mitig':204C 'model':130C 'mutual':246C 'name':117C 'narrow':240C 'need':231C,258C 'network':71B,101C,167C 'npm':34B 'one':212C,243C 'openclaw':1A,21A,22A,35B,39B,68B,109C,125C,175C,209C 'oper':129C,133C,182C,223C 'patch':195C,200C,208C 'path':65B,98C,194C 'plugin':135C 'polici':50B,110C,146C,176C 'practic':177C 'qq85':16A 'reach':69B,100C,166C,192C 'reachabl':163C 'refus':77B 'releas':210C 'remain':141C 'restrict':217C 'sandbox':149C 'scope':114C 'self':37B 'self-host':36B 'separ':145C 'share':242C 'stabl':199C 'summari':78C 'surfac':140C 'tool':28B,238C 'trust':61B,93C,128C,142C,189C,222C 'trusted-oper':127C 'unless':143C 'untrust':247C 'upgrad':205C,216C 'url':9A,46B,86C 'user':248C 'version':89C,196C,201C 'websocket':8A,45B,85C 'whether':186C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-13T22:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3x84-qq85-fj65","url":"https://github.com/advisories/GHSA-3x84-qq85-fj65","severity":"medium","published_at":"2026-10-21T19:37:42+00:00","modified_at":"2026-10-21T19:37:44+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62197","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62197","severity":null,"published_at":"2026-07-13T22:16:51+00:00","modified_at":"2026-07-14T17:46:43+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}