CVE-2026-28395CWE-1327

OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl

Medium · published March 5, 2026

CVSS v4.0
6.3
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server that treats wildcard hosts as loopback addresses, allowing the relay HTTP/WS server to bind to all interfaces when a wildcard cdpUrl is configured. Remote attackers can access relay HTTP endpoints off-host to leak service presence and port information, or conduct denial-of-service and brute-force attacks against the relay token header.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00756 · 54.7th percentile
Weakness
CWE-1327 · Binding to an Unrestricted IP Address
Published
2026-03-05T21:59Z
EPSS history
Timeline
  • 05 MAR 21:59Z
    OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl
    cvelistv5