OpenClaw CVE-2026-41372

OpenClaw must have Chrome DevTools Protocol (CDP) discovery enabled and actively accepting discovery responses from the network. The attacker must be able to inject or intercept CDP discovery responses (via mDNS, DNS spoofing, ARP spoofing, network sniffing, or compromised network infrastructure). The loopback protection must be in place (which it is by default, as the vulnerability describes a bypass of that protection). No special authentication is required on the attacker side because discovery responses are evaluated before authentication checks. The exploitation is limited by network position: the attacker must be on the same network segment or be able to intercept/spoof discovery traffic; remote exploitation from an arbitrary internet location is not feasible unless the OpenClaw instance has been configured to accept CDP discovery from external sources, which would be a non-default configuration. Additionally, successful exploitation requires that the targeted OpenClaw instance actually has an authenticated browser connection active; if no browser session exists, the redirect succeeds but yields no sensitive data.

The CVSS 4.0 vector indicates network attack surface (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), confirming an easily exploitable remote vulnerability. Confidentiality impact is rated low (VC:L), which aligns with exposure of browser state rather than full system compromise. The lack of integrity and availability impacts (VI:N, VA:N, SA:N) reflects that this is primarily a data disclosure issue. EPSS exploitation probability is not provided in the input, so relative risk cannot be cross-validated against real-world prevalence signals. KEV (CISA Known Exploited Vulnerabilities) status is not indicated in the input-if this is genuinely a future-dated CVE (2026), no real-world exploitation data can exist. The authentication bypass tag and low-complexity network attack vector suggest real risk to any OpenClaw deployment accepting external CDP discovery responses. However, practical impact depends on deployment context: if OpenClaw is isolated to internal networks or only accepts discovery from trusted sources, exploitation becomes significantly harder despite low CVSS complexity. Defenders should verify whether CDP discovery is enabled, whether discovery responses are validated/signed, and whether network segmentation limits CDP endpoint reachability.

An attacker on the same network as an OpenClaw instance crafts a malicious mDNS or HTTP discovery response advertising a CDP endpoint at 'localhost.' (with trailing dot) instead of 'localhost' or a legitimate external service. When OpenClaw parses the response, it fails to normalize the trailing dot and treats 'localhost.' as distinct from the loopback whitelist entry 'localhost', bypassing the loopback protection check. The OpenClaw instance then connects to the attacker's endpoint with the authenticated browser context, allowing the attacker to intercept and manipulate browser state, read authentication tokens, or inject malicious JavaScript into the browser session.