High severity8.1NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026
CVE-2026-28458
CVE-2026-28458
Description
OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | >= 2026.1.20, < 2026.2.1 | 2026.2.1 |
moltbotnpm | <= 0.1.0 | — |
Affected products
4- ghsa-coords2 versions
<= 0.1.0+ 1 more
- (no CPE)range: <= 0.1.0
- (no CPE)range: >= 2026.1.20, < 2026.2.1
Patches
Vulnerability mechanics
References
6- github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5cnvdPatchWEB
- github.com/advisories/GHSA-mr32-vwc2-5j6hghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-mr32-vwc2-5j6hnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-28458ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-missing-authentication-in-browser-relay-cdp-websocket-endpointnvdThird Party AdvisoryWEB
- github.com/openclaw/openclaw/releases/tag/v2026.2.1ghsaWEB
News mentions
0No linked articles in our index yet.