---
id: "CVE-2026-62197"
kind: "vulnerability"
aliases: ["CVE-2026-62197", "GHSA-3x84-qq85-fj65"]
title: "OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs"
severity: "high"
cvss: 8.5
epss: 0.0033400000538676977
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "openclaw", "fixed": ["2026.6.6"], "affected": "< 2026.6.6", "ecosystem": "npm"}, {"name": "openclaw", "fixed": ["2026.6.6"], "affected": "< 2026.6.6", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["ai-agents", "ai-tooling", "cwe-284", "cwe-918", "mcp", "npm", "openclaw", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-07-13T22:16:51+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-3x84-qq85-fj65", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62197", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

OpenClaw's browser CDP discovery accepted WebSocket URLs that its own policy should have blocked. An attacker who can feed lower-trust input into that path can make OpenClaw reach internal network destinations it is meant to refuse.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:openclaw affected < 2026.6.6 fixed 2026.6.6
- vendor:openclaw affected < 2026.6.6 fixed 2026.6.6

## How to check

Run npm ls openclaw to find the installed version; affected if below 2026.6.6.
Check whether the browser CDP discovery feature is enabled in your OpenClaw configuration; the sources do not name the exact setting.

## Fix

Upgrade the openclaw npm package to 2026.6.6 or later.
Until then, restrict the browser feature to trusted operators or disable it when not needed.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-3x84-qq85-fj65
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62197

## From the sources

### Summary

Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

### Impact

When the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

### Patched Versions

The first stable patched version is `2026.6.6`.

### Mitigations

Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_