Executive brief
OpenClaw, a tool used for browser automation and remote control, contains a security flaw in its Chrome extension relay server. When configured with certain settings, the relay server incorrectly makes itself available to the entire network instead of just the local computer. This could allow unauthorized individuals on the same network to detect the service, perform denial-of-service attacks, or attempt to guess security tokens to gain further access.
Technical details
An improper network binding vulnerability (CWE-1327) exists in the OpenClaw Chrome extension relay server. The vulnerability stems from the relay server treating wildcard hosts as loopback addresses, which causes the HTTP/WebSocket server to bind to all available network interfaces (0.0.0.0) when a wildcard 'cdpUrl' is configured. A remote attacker on the same network can reach these relay endpoints to leak service presence, identify open ports, or launch brute-force attacks against the relay token header. The issue is fixed in version 2026.2.12 by ensuring proper host validation and binding.
Affected products
- OpenClaw OpenClaw 2026.1.14-1 to 2026.2.12
Timeline
- 2026-03-05: advisory: Initial disclosure of CVE-2026-28395
- 2026-02-01: patched: Fix committed to repository
References
- https://github.com/openclaw/openclaw/commit/8d75a496bf5aaab1755c56cf48502d967c75a1d0
- https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c
- https://github.com/openclaw/openclaw/security/advisories/GHSA-qw99-grcx-4pvm
- https://www.vulncheck.com/advisories/openclaw-unintended-public-binding-of-chrome-extension-relay-via-wildcard-cdpurl