OpenClaw SSRF pivot in CDP WebSocket URL

Executive brief

OpenClaw, a tool used for AI infrastructure scanning and red teaming, is vulnerable to a security flaw where it could be tricked into connecting to unauthorized servers. An attacker could exploit this to perform a 'second-hop' attack, potentially accessing internal systems or data that should be protected. This could lead to unauthorized information disclosure or a foothold in a private network.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in OpenClaw due to insufficient validation of the 'webSocketDebuggerUrl' in CDP /json/version responses. An attacker can provide a response that points to a different host, allowing for a second-hop pivot to untrusted targets. The vulnerability is exploited when a browser profile trusts a malicious CDP response. The fix involves normalizing and re-validating direct CDP WebSocket targets before establishing a connection. This issue is addressed in version 2026.4.5 and later.

Affected products

• openclaw openclaw < 2026.4.5

Timeline

• 2026-04-16: patched: First stable tag containing the fix is v2026.4.5
• 2026-04-17: advisory

References

• https://api.github.com/users/nicky-cc
• https://github.com/nicky-cc
• https://api.github.com/users/nicky-cc/gists%7B/gist_id%7D
• https://api.github.com/users/nicky-cc/repos
• https://avatars.githubusercontent.com/u/12016013?v=4
• https://api.github.com/users/nicky-cc/events%7B/privacy%7D