CVE-2026-62197: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

During browser CDP discovery, OpenClaw checks the WebSocket URL it is handed against its destination policy. In affected versions that check accepted URLs it should have rejected. The result is SSRF (CWE-918) with an access control failure (CWE-284): the Gateway host makes a connection that the policy was meant to forbid.

The advisory scopes this to the browser feature and its configuration. It does not change OpenClaw's trusted-operator model. Authenticated Gateway operators and installed plugins stay trusted. The risk is real only when the browser feature is enabled and reachable and lower-trust input, such as a user sharing the Gateway or a configured input path, can influence the discovery URL.

The CVSS 4.0 vector shows network access, low privileges and no user interaction. It records no direct confidentiality or integrity loss on OpenClaw itself, but high confidentiality impact on a subsequent system. That fits internal services, such as metadata endpoints or local admin ports, being reached through the Gateway host. Neither source names the exact function or setting.

Every openclaw npm release before 2026.6.6 is affected. Exposure depends on the browser CDP feature being enabled and on lower-trust callers being able to reach it. Deployments where one Gateway serves mutually untrusted users are the most exposed.

Check your installed version:

npm ls openclaw

Upgrade to 2026.6.6, the first stable patched version:

npm install [email protected]

Before upgrading, the advisory says to restrict the browser feature to trusted operators or disable it if you do not need it. It also advises keeping channel and tool allowlists narrow and not sharing one Gateway between mutually untrusted users.

The sources give no log signature. Review Gateway logs and egress records for browser or CDP discovery connections to hosts you did not intend, especially internal ranges and loopback addresses, and for WebSocket URLs that your policy would block. Check who could submit input to the browser feature. Beam records agent shell commands and MCP tool calls, so it can show an agent driving a browser tool toward unexpected destinations.

Summary

Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.6.6.

Mitigations

Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.