OpenClaw before version 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay. The vulnerability exposes Chrome DevTools Protocol on 0.0.0.0, allowing attackers to access the DevTools protocol outside intended local sandbox boundaries. This is caused by an overly broad binding configuration in the CDP relay component. The vulnerability affects the security boundaries of the sandbox environment and could allow unauthorized remote access to debugging capabilities.