N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-525j-hqq2-66r4

GHSA-525j-hqq2-66r4: OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

Summary

Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0.

Affected Packages / Versions

Package: openclaw
Ecosystem: npm
Affected versions: < 2026.4.10
Patched versions: >= 2026.4.10

Impact

The sandbox browser CDP relay could bind too broadly, exposing Chrome DevTools Protocol access outside the intended local/sandbox source range.

Technical Details

The fix enforces CDP source-range restriction by default and avoids broad 0.0.0.0 exposure unless explicitly configured.

Fix

The issue was fixed in #61404. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.

Fix Commit(s)

fbf11ebdb7110632f93926d0ac7b48f04cb44d77
PR: #61404

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-525j-hqq2-66r4

GHSA-525j-hqq2-66r4:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.10	2026.4.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-525j-hqq2-66r4, stems from the OpenClaw sandbox browser's Chrome DevTools Protocol (CDP) relay binding to 0.0.0.0 without IP restrictions, exposing it to other containers on the same Docker network. The root cause within the application code is the ensureSandboxBrowser function in src/agents/sandbox/browser.ts. This function orchestrates the creation of the sandbox container.

Prior to the fix, ensureSandboxBrowser would only pass the CDP_SOURCE_RANGE environment variable to the container if it was explicitly defined in the user's configuration. If undefined, the container's entrypoint script (scripts/sandbox-browser-entrypoint.sh) would default to starting a socat process that listened on 0.0.0.0 without any range restriction, creating the vulnerability.

The patch addresses this by modifying ensureSandboxBrowser to be fail-safe. It now ensures that CDP_SOURCE_RANGE is always set. If not explicitly configured, the function attempts to derive it from the Docker network's gateway IP for bridge-like networks. If a source range cannot be determined, the function throws an error, preventing the container from starting in an insecure configuration. This change ensures that the CDP relay is always restricted, mitigating the risk of unauthorized access.

Vulnerable functions

ensureSandboxBrowser

src/agents/sandbox/browser.ts

The `ensureSandboxBrowser` function is responsible for creating and configuring the sandbox browser container. Before the patch, this function did not enforce the `cdpSourceRange` setting, which is critical for restricting access to the Chrome DevTools Protocol (CDP). If this setting was omitted from the configuration, the function would proceed to create a container where the entrypoint script started a `socat` relay, binding the CDP port to the unrestricted `0.0.0.0` address. This exposed the CDP to any other container on the same network. The vulnerability lies in this function's failure to enforce a secure-by-default configuration. The patch rectifies this by adding logic to automatically derive a safe `cdpSourceRange` from the Docker network gateway or throwing an error if a safe range cannot be determined, thus preventing the container from starting in an insecure state.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-525j-hqq2-66r4: OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

GHSA-525j-hqq2-66r4:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-525j-hqq2-66r4: OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

Summary

Affected Packages / Versions

Impact

Technical Details

Fix

Fix Commit(s)

Release Process Note

Credits

Technical Details

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI