CVE-2026-28458: Openclaw Authentication Bypass Vulnerability

CVE-2026-28458 Overview

CVE-2026-28458 is a missing authentication vulnerability [CWE-306] in OpenClaw, a Node.js based automation tool. Versions 2026.1.20 through versions prior to 2026.2.1 expose a Chrome DevTools Protocol (CDP) WebSocket endpoint at ws://127.0.0.1:18792/cdp without requiring authentication tokens. When the Browser Relay extension is installed and enabled, any website loaded in the user's browser can connect to this loopback endpoint. Attackers can use the connection to steal session cookies and execute JavaScript in other browser tabs.

Critical Impact
Malicious websites can bridge to a user's authenticated browser session, exfiltrate cookies, and execute arbitrary JavaScript across other tabs via the unauthenticated CDP WebSocket.

Affected Products

OpenClaw 2026.1.20 and later releases prior to 2026.2.1
Deployments running the Browser Relay Chrome extension component
Node.js based OpenClaw installations exposing the /cdp endpoint on loopback port 18792

Discovery Timeline

2026-03-05 - CVE-2026-28458 published to NVD
2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-28458

Vulnerability Analysis

The vulnerability resides in OpenClaw's Browser Relay component, which exposes a Chrome DevTools Protocol WebSocket server on the local loopback interface. The /cdp endpoint accepts WebSocket upgrade requests without validating any authentication header or token. Because browsers permit JavaScript on any origin to open WebSocket connections to 127.0.0.1, a user visiting an attacker-controlled page becomes a viable target.

Once a connection is established, the attacker speaks CDP directly to the relay. CDP exposes high-privilege commands including Network.getAllCookies, Runtime.evaluate, and Target.attachToTarget. The attacker can enumerate other tabs, harvest authenticated session cookies, and inject JavaScript into pages where the user is logged in. The result is a same-host privilege boundary failure between untrusted web origins and a privileged local automation interface.

Root Cause

The Browser Relay WebSocket server did not implement an authentication check on incoming upgrade requests. Loopback binding was treated as a sufficient trust boundary, but browser-based attackers running JavaScript on an arbitrary origin can reach loopback services. There was no token, origin allowlist, or handshake secret protecting the /cdp route.

Attack Vector

The attack requires the victim to visit a malicious or compromised web page while OpenClaw and its Browser Relay extension are running. JavaScript on that page opens a WebSocket to ws://127.0.0.1:18792/cdp, then issues CDP commands to extract cookies and run script in authenticated tabs.

typescript

// Patch excerpt: src/browser/cdp.helpers.ts
 import WebSocket from "ws";
 import { rawDataToString } from "../infra/ws.js";
+import { getChromeExtensionRelayAuthHeaders } from "./extension-relay.js";
 
 type CdpResponse = {
   id: number;

// Patch excerpt: src/browser/extension-relay.ts
+import type { IncomingMessage } from "node:http";
 import type { AddressInfo } from "node:net";
 import type { Duplex } from "node:stream";
+import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import WebSocket, { WebSocketServer } from "ws";
 import { rawDataToString } from "../infra/ws.js";

Source: openclaw/openclaw commit a1e89af. The fix introduces a randomly generated authentication header via randomBytes and validates it on the incoming IncomingMessage before allowing the WebSocket upgrade.

Detection Methods for CVE-2026-28458

Indicators of Compromise

Outbound or local WebSocket connections from browser tabs to ws://127.0.0.1:18792/cdp originating from non-developer web origins.
OpenClaw process logs showing repeated /cdp upgrade requests without an associated relay extension session.
Unexpected CDP command traffic such as Network.getAllCookies or Runtime.evaluate against the relay endpoint.

Detection Strategies

Inspect host network telemetry for loopback traffic to TCP port 18792 initiated by the browser renderer process.
Review browser extension and devtools logs for CDP sessions opened from unfamiliar tab origins.
Hunt for installed OpenClaw versions between 2026.1.20 and 2026.2.0 across managed endpoints.

Monitoring Recommendations

Alert on new listeners bound to 127.0.0.1:18792 and correlate with the parent process to confirm it is OpenClaw.
Track outbound exfiltration of cookie-shaped data following local CDP activity.
Inventory Chrome extensions and flag the OpenClaw Browser Relay extension on hosts that should not have it enabled.

How to Mitigate CVE-2026-28458

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.1 or later, which adds authentication headers to the Browser Relay /cdp endpoint.
Disable or uninstall the OpenClaw Browser Relay Chrome extension on hosts that do not require it until patching is complete.
Restrict outbound browsing on hosts running vulnerable OpenClaw versions to limit exposure to attacker-controlled pages.

Patch Information

The upstream fix is published in openclaw/openclaw commit a1e89af and tracked in the GitHub Security Advisory GHSA-mr32-vwc2-5j6h. Additional analysis is available in the VulnCheck Advisory. The patch generates a per-session secret with randomBytes and validates it against incoming WebSocket upgrade requests in extension-relay.ts.

Workarounds

Stop the OpenClaw process or close the Browser Relay extension when not actively automating browser sessions.
Block inbound connections to 127.0.0.1:18792 from the local browser using a host firewall rule where supported.
Limit OpenClaw usage to isolated test machines that do not hold authenticated sessions to production services.

bash

# Verify the installed OpenClaw version and upgrade
npm ls openclaw
npm install openclaw@2026.2.1

# Confirm the relay port is no longer accepting unauthenticated upgrades
ss -tlnp | grep 18792