OpenClaw before version 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay. The vulnerability exposes Chrome DevTools Protocol on 0.0.0.0, allowing attackers to access the DevTools protocol outside intended local sandbox boundaries. This occurs due to an overly broad binding configuration that breaks sandbox security boundaries. Attackers can exploit this configuration flaw to gain unauthorized access to debugging capabilities that should be restricted to local access only.