5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-v3j7-34xh-6g3w

GHSA-v3j7-34xh-6g3w: OpenClaw Loopback CDP probe can leak Gateway token to local listener

Summary

A local process can capture the OpenClaw Gateway auth token from Chrome CDP probe traffic on loopback.

Details

Affected versions inject x-openclaw-relay-token for loopback CDP URLs, and CDP reachability probes send that header to /json/version. If an attacker controls the probed loopback port, they can read that token and reuse it as Gateway bearer auth.

Relevant code paths (pre-fix):

src/browser/extension-relay.ts (getChromeExtensionRelayAuthHeaders)
src/browser/cdp.helpers.ts (getHeadersWithAuth)
src/browser/chrome.ts (fetchChromeVersion)

Affected Packages / Versions

Package: openclaw (npm)
Latest published (at triage): 2026.2.21-2
Vulnerable: <= 2026.2.21-2
Patched: >= 2026.2.22

Deployment Model Applicability

This does not change OpenClaw’s documented security model for standard single-owner installs (you own the machine/VPS and trust local processes under that OS account boundary). Risk is for non-standard shared-user/shared-host installs where an untrusted local user/process can race/bind the loopback relay port.

Impact

Local credential disclosure.
Follow-on impact depends on local deployment and enabled Gateway capabilities.

Fix Commit(s)

afa22acc4a09fdf32be8a167ae216bee85c30dad

Release Process Note

Patched version is set to >= 2026.2.22 for the published release.

OpenClaw thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-v3j7-34xh-6g3w

GHSA-v3j7-34xh-6g3w:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.21-2	2026.2.22

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the mechanism used by OpenClaw to authenticate to the Chrome DevTools Protocol (CDP) endpoint over a loopback connection. The core issue, located in src/browser/extension-relay.ts, is that the system would use its main, high-privilege gateway authentication token as a bearer token for these local probes.

The exploitation path is as follows:

The resolveGatewayAuthToken function would fetch the raw OPENCLAW_GATEWAY_TOKEN.
The relayAuthTokenForUrl function would incorrectly approve the use of this token for any request to a loopback address (e.g., 127.0.0.1), without verifying that an OpenClaw service was actually listening on the target port.
The getChromeExtensionRelayAuthHeaders function would then create an x-openclaw-relay-token HTTP header containing this sensitive token.
A higher-level function, such as fetchChromeVersion, would make an HTTP request to probe a CDP port (e.g., http://127.0.0.1:9222/json/version), sending the header with the gateway token.

An attacker with the ability to run a process on the same machine could predict or cause OpenClaw to probe a specific port they are listening on. The attacker's process would then receive the probe request and simply read the gateway token from the x-openclaw-relay-token header, resulting in a local privilege escalation.

The patch addresses this by ceasing the use of the raw gateway token for probes. Instead, it generates a derived, port-specific HMAC-based token. It also ensures that tokens are only generated for ports that are confirmed to be running an authenticated OpenClaw relay server.

Vulnerable functions

relayAuthTokenForUrl

src/browser/extension-relay.ts

This function contained the primary logic flaw. It would return the raw gateway authentication token for any URL that resolved to a loopback host, without verifying if an OpenClaw relay server was actually running on that port. This allowed the token to be sent to potentially malicious local listeners.

resolveGatewayAuthToken

src/browser/extension-relay.ts

This function was responsible for retrieving the sensitive gateway authentication token from environment variables or the configuration file. The token it returned was then improperly used directly as a bearer token for loopback CDP probes, leading to the credential leak. The fix replaces this direct usage with a derived, port-specific token.

getChromeExtensionRelayAuthHeaders

src/browser/extension-relay.ts

This function constructs the HTTP headers for relaying requests. It called the vulnerable `relayAuthTokenForUrl` function and then placed the returned raw gateway token into the `x-openclaw-relay-token` header, which was then sent over the loopback interface, making it accessible to other local processes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.7

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-v3j7-34xh-6g3w: OpenClaw Loopback CDP probe can leak Gateway token to local listener

Summary

Details

Affected Packages / Versions

Deployment Model Applicability

Impact

Fix Commit(s)

Release Process Note

GHSA-v3j7-34xh-6g3w:

5.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

5.7

5.7

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-v3j7-34xh-6g3w: OpenClaw Loopback CDP probe can leak Gateway token to local listener

Summary

Details

Affected Packages / Versions

Deployment Model Applicability

Impact

Fix Commit(s)

Release Process Note

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI