CVE-2026-28395
📋 TL;DR
OpenClaw versions 2026.1.14-1 through 2026.2.11 contain an improper network binding vulnerability in the Chrome extension relay server. When configured with a wildcard cdpUrl, the server binds to all network interfaces instead of only loopback addresses, allowing remote attackers to discover and potentially attack the relay service. This affects users running OpenClaw with the Chrome extension relay server enabled.
💻 Affected Systems
- OpenClaw
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers could conduct denial-of-service attacks against the relay server, brute-force relay tokens, and leak service presence information to facilitate further attacks.
Likely Case
Attackers scanning networks discover exposed relay servers, gather reconnaissance data about services and ports, and potentially disrupt relay functionality.
If Mitigated
With proper network segmentation and firewall rules, impact is limited to information disclosure about service presence.
🎯 Exploit Status
Exploitation requires network access to the relay server port and knowledge of the service endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.2.12 and later
Vendor Advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-qw99-grcx-4pvm
Restart Required: Yes
Instructions:
1. Update OpenClaw to version 2026.2.12 or later. 2. Restart the OpenClaw service. 3. Verify the Chrome extension relay server configuration no longer uses wildcard cdpUrl.
🔧 Temporary Workarounds
Restrict network binding
allConfigure the relay server to bind only to loopback addresses (127.0.0.1, ::1) instead of wildcard addresses.
Edit OpenClaw configuration to set cdpUrl to 'http://127.0.0.1:PORT' or 'http://[::1]:PORT'
Firewall restriction
allUse host firewall to block external access to the relay server port.
Linux: sudo iptables -A INPUT -p tcp --dport PORT -s 127.0.0.1 -j ACCEPT && sudo iptables -A INPUT -p tcp --dport PORT -j DROP
Windows: New-NetFirewallRule -DisplayName 'Block OpenClaw Relay' -Direction Inbound -LocalPort PORT -Protocol TCP -Action Block
🧯 If You Can't Patch
- Disable the Chrome extension relay server if not required.
- Implement network segmentation to isolate OpenClaw servers from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check OpenClaw version and verify if Chrome extension relay server is enabled with wildcard cdpUrl configuration.Check Version:
openclaw --versionVerify Fix Applied:
Confirm OpenClaw version is 2026.2.12 or later and relay server binds only to loopback addresses.📡 Detection & Monitoring
Log Indicators:
- Unexpected external connections to relay server port
- Failed authentication attempts to relay endpoints
Network Indicators:
- External network scans targeting relay server default ports
- Unusual HTTP/WS traffic to OpenClaw relay endpoints from external IPs
SIEM Query:
source_ip NOT IN (127.0.0.0/8, ::1) AND dest_port = RELAY_PORT AND protocol = TCP🔗 References
- https://github.com/openclaw/openclaw/commit/8d75a496bf5aaab1755c56cf48502d967c75a1d0
- https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qw99-grcx-4pvm
- https://www.vulncheck.com/advisories/openclaw-unintended-public-binding-of-chrome-extension-relay-via-wildcard-cdpurl
