CVE-2026-62197 Overview
CVE-2026-62197 is a policy bypass vulnerability in OpenClaw versions prior to 2026.6.6. The flaw resides in the browser Chrome DevTools Protocol (CDP) discovery feature, which accepts WebSocket URLs that OpenClaw policy should have blocked. An attacker with lower-trust access can direct the affected feature to network destinations that are outside the intended policy boundary. The issue is categorized as a Server-Side Request Forgery (SSRF) class weakness under [CWE-918].
The vulnerability requires the affected CDP discovery feature to be enabled and low-privilege access to reach it over the network.
Critical Impact
An authenticated low-privilege attacker can bypass OpenClaw network policy through CDP discovery, reaching internal or otherwise blocked WebSocket endpoints.
Affected Products
- OpenClaw (Node.js distribution) versions before 2026.6.6
- Deployments where browser CDP discovery is enabled
- Environments relying on OpenClaw policy to restrict outbound WebSocket destinations
Discovery Timeline
- 2026-07-13 - CVE-2026-62197 published to the National Vulnerability Database
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-62197
Vulnerability Analysis
OpenClaw exposes a CDP discovery mechanism that connects to browser instances over WebSocket URLs. The discovery routine fails to enforce OpenClaw's URL policy before initiating the outbound WebSocket connection. As a result, URLs that policy is intended to block are still accepted and dialed.
Because the request originates from the OpenClaw process, it inherits the trust boundary of the server. This allows an attacker to pivot from a low-privilege position to network destinations that should be unreachable, matching the SSRF pattern described in [CWE-918].
Root Cause
The root cause is missing or incorrect validation of user-influenced WebSocket URLs in the CDP discovery code path. Policy checks that gate other network operations are not applied at this entry point, so blocked destinations pass through to the underlying WebSocket client.
Attack Vector
Exploitation occurs over the network and requires low-level authenticated access to a feature that invokes CDP discovery. The attacker supplies a WebSocket URL pointing to a destination that OpenClaw policy would normally reject, such as an internal service. OpenClaw connects to the destination on the attacker's behalf, exposing responses or state from systems the attacker cannot reach directly. Refer to the VulnCheck Advisory on OpenClaw for additional technical context.
Detection Methods for CVE-2026-62197
Indicators of Compromise
- Outbound WebSocket (ws:// or wss://) connections from the OpenClaw process to internal IP ranges or loopback addresses
- CDP discovery log entries referencing hostnames or URLs that should be blocked by policy
- Unexpected connections from OpenClaw hosts to metadata endpoints such as 169.254.169.254
Detection Strategies
- Review OpenClaw application logs for CDP discovery events that resolve to destinations outside the approved allowlist
- Correlate process telemetry from the OpenClaw runtime with network flow data to identify policy-inconsistent WebSocket sessions
- Alert on new or unusual WebSocket handshakes originating from Node.js processes hosting OpenClaw
Monitoring Recommendations
- Enable verbose logging on OpenClaw policy decisions and forward events to a centralized log platform
- Monitor egress traffic from OpenClaw hosts and baseline expected WebSocket destinations
- Track version strings in deployment inventories to identify hosts still running OpenClaw releases prior to 2026.6.6
How to Mitigate CVE-2026-62197
Immediate Actions Required
- Upgrade OpenClaw to version 2026.6.6 or later on all affected hosts
- Audit which deployments have browser CDP discovery enabled and disable it where it is not required
- Restrict network egress from OpenClaw hosts so that internal services and cloud metadata endpoints are not reachable
Patch Information
The fix is delivered in OpenClaw 2026.6.6. Details are published in the GitHub Security Advisory GHSA-3x84-qq85-fj65. Operators should validate the installed version after upgrade and confirm the CDP discovery code path applies policy checks.
Workarounds
- Disable the browser CDP discovery feature until the patched version can be deployed
- Enforce network-layer egress filtering to block WebSocket traffic from OpenClaw to internal address ranges
- Limit which accounts can invoke features that trigger CDP discovery to reduce the attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
