OpenClaw CVE-2026-62197

Q: What is the CVSS score of CVE-2026-62197?

CVE-2026-62197 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-13 VulnCheck

SSRF Openclaw

6.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-accessible SSRF with scope change to internal systems; lower-trust auth required (PR:L); no direct vulnerable-system impact but high confidentiality breach on subsequent network targets.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 22:12 vuln.today

DescriptionCVE.org

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

AnalysisAI

OpenClaw's browser CDP (Chrome DevTools Protocol) discovery component fails to enforce its own URL blocklist, allowing lower-trust authenticated users to reach network destinations that OpenClaw policy should have denied access to. The root cause is a Server-Side Request Forgery variant (CWE-918) where blocked WebSocket URLs submitted through CDP discovery are accepted and proxied without policy enforcement. The CVSS 4.0 vector (SC:H/SI:L) confirms the primary impact lands on downstream or segmented network resources - not OpenClaw itself - making this a network segmentation bypass rather than a direct system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is a browser automation or proxy tool that integrates with Chrome DevTools Protocol (CDP) for browser session discovery. CDP uses WebSocket connections for communication, and OpenClaw implements a URL policy layer intended to block access to restricted network destinations. CWE-918 (Server-Side Request Forgery) describes the root cause: the CDP discovery subsystem fails to validate or enforce the configured blocklist when handling inbound WebSocket URL requests, effectively using the OpenClaw server as a proxy to reach otherwise-inaccessible segments. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with SC:H/SI:L and no vulnerable-system impact (VC:N/VI:N/VA:N) is consistent with a classic SSRF pattern where the attacker's direct target is the internal network, not the intermediary application.

RemediationAI

The primary remediation is to upgrade OpenClaw to version 2026.6.6 or later, which addresses the policy enforcement failure in the CDP discovery component per the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-3x84-qq85-fj65. As a compensating control where immediate upgrade is not possible, operators should disable the browser CDP discovery feature if it is not operationally required - this eliminates the attack surface entirely but will break any automation or browser session workflows that depend on CDP integration. Alternatively, restricting lower-trust user accounts from accessing the CDP discovery functionality via access controls reduces the exploitable privilege level, though the precise mechanism depends on OpenClaw's authorization model. Network-layer egress filtering that independently enforces the same destination blocklist at the firewall or proxy level would mitigate the SSRF bypass even if OpenClaw's internal policy fails, and is recommended as defense-in-depth regardless of patching status. Additional context is available from VulnCheck at https://www.vulncheck.com/advisories/openclaw-policy-bypass-via-cdp-discovery.