OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

TRUNG BÌNH 5.8CVE-2026-41372 · GHSA-fh32-73r9-rgh5 · Công bố 28/04/2026 · cập nhật 24/07/2026

Tóm tắt nhanh

CVE-2026-41372 là lỗ hổng mức TRUNG BÌNH (CVSS 5.8) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.25%, cao hơn 16.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.4.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.4.2`	`2026.4.2`
openclaw npm	`< 2026.4.2`	`2026.4.2`

Mô tả

Summary

Before OpenClaw 2026.4.2, remote CDP discovery could return a trailing-dot localhost host such as localhost. and bypass OpenClaw's loopback-host normalization. That let a non-loopback remote CDP profile pivot the follow-up connection back onto localhost.

Impact

A hostile discovery response could retarget authenticated browser control toward a localhost-resolving endpoint on the OpenClaw host. This weakened the existing remote-CDP loopback protection and could expose localhost-backed browser state.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

9c22d636697336a6b22b0ae24798d8b8325d7828 — normalize localhost absolute-form CDP hosts before loopback checks

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @smaeljaish771 for reporting.

Mô tả của NVD

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.