MEDIUM 8.5 GitHub
CVE-2026-62197
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
### Summary
Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, san
Affected Products
- npm/openclaw < 2026.6.6
References
- https://github.com/advisories/GHSA-3x84-qq85-fj65
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3x84-qq85-fj65
- https://nvd.nist.gov/vuln/detail/CVE-2026-62197
- https://www.vulncheck.com/advisories/openclaw-policy-bypass-via-cdp-discovery
This medium severity vulnerability with a CVSS score of 8.5 was published on 2026-10-21 via GitHub. Affected: npm/openclaw < 2026.6.6.
vulnfeed aggregates 18720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.