OpenClaw CVE-2026-62197

Exploitation requires that the target OpenClaw instance has the browser CDP discovery feature enabled - this is the specific component containing the policy bypass. The attacker must hold lower-trust authenticated access to OpenClaw (PR:L per CVSS 4.0 vector); unauthenticated exploitation is not supported by the available data. The vulnerability is only meaningful in environments where OpenClaw has been configured with a URL blocklist intended to restrict access to certain network destinations, since the attack's value lies in bypassing that enforced boundary. Deployments without a configured URL blocklist, or those where CDP discovery is disabled, are not exposed to the core risk. No user interaction is required once the attacker has authenticated access. The impact is limited to the network destinations reachable by the OpenClaw server process, not the OpenClaw system itself.

The CVSS 4.0 score of 6.3 with PR:L indicates exploitation requires authenticated but lower-privileged access, moderately constraining opportunistic mass exploitation. The high subsequent-system confidentiality impact (SC:H) reflects that a successful bypass can expose sensitive internal network resources - potentially including non-public APIs, metadata services, or internal hosts - that policy was explicitly configured to protect. Attack complexity is Low (AC:L) and no attack prerequisites apply (AT:N), meaning once an attacker has lower-trust credentials, exploitation is straightforward if the CDP discovery feature is enabled. No public exploit code has been identified and the vulnerability is not in the CISA KEV catalog, suggesting limited observed exploitation. EPSS data is not available in the provided intelligence. The practical risk is highest in multi-tenant environments or deployments where OpenClaw serves users of varying trust levels with network policy enforcement as a security boundary - in those contexts, this is a meaningful privilege escalation vector against the network perimeter. In single-tenant or internally-facing deployments with strong network controls already in place, residual risk is lower.

An attacker with lower-trust access to an OpenClaw instance crafts a CDP discovery request containing a WebSocket URL pointing to a blocked internal destination - such as a cloud metadata endpoint or an internal API server - that OpenClaw policy is configured to deny. OpenClaw's policy check fails to reject the blocked URL during CDP discovery processing and forwards the connection, allowing the attacker to retrieve responses from the restricted internal network resource. No public proof-of-concept exploit has been identified, but the attack complexity is low and exploitation requires only lower-privilege credentials, making it readily reproducible by any authenticated user who understands CDP WebSocket URL formatting.