GHSA-mr32-vwc2-5j6h

Suggest an improvement
Source
https://github.com/advisories/GHSA-mr32-vwc2-5j6h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mr32-vwc2-5j6h/GHSA-mr32-vwc2-5j6h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mr32-vwc2-5j6h
Aliases
Published
2026-02-17T16:45:47Z
Modified
2026-03-06T01:18:35Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access
Details

Summary

In affected versions, the Browser Relay /cdp WebSocket endpoint did not require an authentication token. As a result, a website running in the browser could potentially connect to the local relay (via loopback WebSocket) and use CDP to access cookies from other open tabs and run JavaScript in the context of other tabs.

Affected Packages / Versions

  • npm: openclaw >= 2026.1.20, < 2026.2.1
  • npm: moltbot <= 0.1.0

Details

The Chrome extension Browser Relay service exposes a local WebSocket endpoint at ws://127.0.0.1:18792/cdp (default port) for forwarding Chrome DevTools Protocol (CDP) messages.

In affected versions, the /cdp upgrade path verified the TCP peer was loopback but did not require a shared secret and did not block browser-initiated cross-origin requests.

Impact

  • Potential disclosure of sensitive information (for example, session cookies from other open tabs)
  • Potential JavaScript execution in the context of other open tabs

Users must have the Browser Relay extension installed and active, and must visit an untrusted site.

Fix

openclaw now requires a per-instance shared secret header for Browser Relay access:

  • HTTP header: x-openclaw-relay-token

It also rejects /cdp WebSocket upgrades when the Origin header is present but is not chrome-extension://..., and refuses /cdp connections unless the extension is connected.

Fix Commit(s)

  • a1e89afcc19efd641c02b24d66d689f181ae2b5c

Releases

  • openclaw@2026.2.1 includes the fix.
  • Latest published openclaw at time of writing: 2026.2.13.

Mitigation

  • Update to openclaw@>= 2026.2.1.
  • If you cannot update immediately, disable the Browser Relay extension / relay server and avoid visiting untrusted sites.

Thanks @johnatzeropath, @LeftenantZero, and @yueyueL for reporting.

Database specific 
{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-17T16:45:47Z",
    "nvd_published_at":  "2026-03-05T22:16:18Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
2026.1.20
Fixed
2026.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mr32-vwc2-5j6h/GHSA-mr32-vwc2-5j6h.json"

npm / moltbot

Package

Name
moltbot
View open source insights on deps.dev
Purl
pkg:npm/moltbot

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.1.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mr32-vwc2-5j6h/GHSA-mr32-vwc2-5j6h.json"