cyfenced.com →

[ CVE-2026-62197 · Published 13 Jul 2026 ]

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

CVSS 8.5 EPSS <1%Fix available

[ Description ]Official description

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

[ Fixes ]Fixes and patches

  • openclaw 2026.6.6Fixed version · GitHub Advisories · npm package openclaw: upgrade to 2026.6.6 or later (affected < 2026.6.6)

[ Packages ]Affected open-source packages

[ References ]References