GHSA-fh32-73r9-rgh5

Source

https://github.com/advisories/GHSA-fh32-73r9-rgh5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-fh32-73r9-rgh5/GHSA-fh32-73r9-rgh5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fh32-73r9-rgh5

Aliases

CVE-2026-41372

Downstream

MINI-hjgh-jg7v-8xhw

Published

2026-04-07T18:15:56Z

Modified

2026-05-06T19:22:43.320468Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator

Summary

OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

Details

Summary

Before OpenClaw 2026.4.2, remote CDP discovery could return a trailing-dot localhost host such as localhost. and bypass OpenClaw's loopback-host normalization. That let a non-loopback remote CDP profile pivot the follow-up connection back onto localhost.

Impact

A hostile discovery response could retarget authenticated browser control toward a localhost-resolving endpoint on the OpenClaw host. This weakened the existing remote-CDP loopback protection and could expose localhost-backed browser state.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

9c22d636697336a6b22b0ae24798d8b8325d7828 — normalize localhost absolute-form CDP hosts before loopback checks

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @smaeljaish771 for reporting.

Database specific

{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed_at": "2026-04-07T18:15:56Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20",
        "CWE-639"
    ]
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2026.4.2

Database specific

last_known_affected_version_range

"<= 2026.4.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-fh32-73r9-rgh5/GHSA-fh32-73r9-rgh5.json"