OpenClaw
CVE-2026-41372
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 5 npm packages depend on openclaw (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.2.
DescriptionCVE.org
OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.
AnalysisAI
OpenClaw before version 2026.4.2 fails to normalize trailing-dot localhost hostnames in Chrome DevTools Protocol (CDP) discovery responses, allowing attackers to bypass loopback address protections. An unauthenticated remote attacker can craft malicious CDP discovery responses that return 'localhost.' (with trailing dot) instead of the standard 'localhost', causing the browser control mechanism to treat it as a different hostname and redirect authenticated browser sessions to attacker-controlled endpoints, potentially exposing sensitive browser state and authentication tokens.
Technical ContextAI
OpenClaw implements Chrome DevTools Protocol (CDP) client functionality for browser automation and debugging. CDP discovery uses DNS-like service discovery or HTTP-based endpoint enumeration to locate CDP websocket endpoints. The vulnerability stems from improper hostname canonicalization: standard DNS and network stacks normalize 'localhost.' (fully qualified with trailing dot) to the same loopback address (127.0.0.1) as 'localhost' (unqualified). OpenClaw's loopback protection logic compares hostnames as strings without normalizing the trailing dot, creating a logical bypass. CWE-639 (Authorization Bypass Through User-Controlled Key) describes this class of flaw where user-influenced input (the attacker-crafted discovery response) bypasses access control checks that rely on string comparison rather than semantic equivalence. The root cause is a hostname validation flaw in the CDP discovery response handler, likely in URL/host parsing code that fails to apply DNS FQDN normalization before checking against a loopback whitelist.
RemediationAI
Upgrade OpenClaw to version 2026.4.2 or later. The fix is confirmed in commit 9c22d636697336a6b22b0ae24798d8b8325d7828 at https://github.com/openclaw/openclaw, which implements proper DNS FQDN normalization for hostname comparison in CDP discovery responses. If immediate patching is not feasible, restrict network access to CDP discovery responses by implementing network segmentation so that only trusted, internal CDP discovery mechanisms can reach the OpenClaw process; alternatively, configure OpenClaw to only accept CDP discovery from hardcoded, pre-configured sources rather than dynamic discovery. Monitor network traffic for suspicious CDP discovery responses containing trailing-dot localhost variants ('localhost.', '127.0.0.1.', etc.). These mitigations are less robust than patching because they rely on network controls that may be bypassed if an attacker gains access to the internal network or can perform man-in-the-middle attacks on CDP discovery channels.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today