Executive brief
OpenClaw is a browser automation library used for testing and debugging web applications. A vulnerability in the Chrome DevTools Protocol (CDP) /json/version endpoint allows an attacker to redirect WebSocket connections to untrusted hosts, potentially exposing internal resources or enabling lateral movement to secondary targets within a trusted network.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in OpenClaw's handling of the CDP /json/version response. When OpenClaw retrieves debugging information via CDP, it trusts the webSocketDebuggerUrl field without proper validation, allowing an attacker-controlled or compromised CDP endpoint to redirect connections to arbitrary second-hop targets. An authenticated user or local network-positioned attacker can exploit this by serving a malicious CDP response with a webSocketDebuggerUrl pointing to an internal service. The fix (v2026.4.5 and later) normalizes and re-validates the WebSocket target before connecting, preventing pivot attacks.
Affected products
- OpenClaw OpenClaw < 2026.4.5
Timeline
- 2026-04-17: disclosed
- 2026-04-17: patched: Fixed in v2026.4.5; v2026.4.14 is latest NPM release