ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-62197

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

Published Oct 21, 2026 · catalog updated Oct 21, 2026 · OpenClaw: Browser CDP discovery

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-62197. EPSS is 0.33%. Act only if a listed version of OpenClaw: Browser CDP discovery is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (OpenClaw: Browser CDP discovery).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.33%
Remediation
Version ranges on file
Affected products
npm openclaw

### Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed. ### Impact When the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path. ### Patched Versions The first stable patched version is . ### Mitigations Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm openclaw< 2026.6.6

How to fix CVE-2026-62197

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-62197. EPSS is 0.33%. Act only if a listed version of OpenClaw: Browser CDP discovery is installed.

Which versions are affected?

Compare what you have installed with < 2026.6.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-284: Improper Access Control; CWE-918: Server-Side Request Forgery (SSRF). EPSS 0.33%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 21, 2026 · GitHub Advisory Database

    Detected

    ### Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and inte

  2. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Summary Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and inte

Sources

  • CVE.orgVulnerability recordCVE-2026-62197

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-62197

    30-day exploitation probability 0.33%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-3x84-qq85-fj65

    OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-62197

    Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional loca

    advisories.gitlab.com
  • urlscan.ioThreat intelligenceCVE-2026-62197
    urlscan.io

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • urlscan.ioNov 2, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • CVE.orgOct 23, 2026
  • FIRST EPSSOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026