OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. …

Published:

5 mei 2026 om 22:00:00

Alert date:

6 mei 2026 om 23:05:11

Source:

nvd.nist.gov

Web Technologies, Security Tools

OpenClaw before version 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay. The vulnerability exposes Chrome DevTools Protocol on 0.0.0.0, allowing attackers to access the DevTools protocol outside intended local sandbox boundaries. This is caused by an overly broad binding configuration in the CDP relay component. The vulnerability affects the security boundaries of the sandbox environment and could allow unauthorized remote access to debugging capabilities.

Technical details

Mitigation steps:

Affected products:

OpenClaw