Patch Forecast
Amber warning
Patch this week.

CVE-2026-62197 ยท GHSA-3x84-qq85-fj65

OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs

Risk score
61/100
CVSS
8.5 v3.1
Exploit chance (30 days)
0.3%
Published
13 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.
Affected
openclaw (npm) < 2026.6.6
Fix
Upgrade openclaw to 2026.6.6 or later.
Exploitation
No known exploitation

Why it is Amber

  • CVSS 8.5 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
openclawnpm< 2026.6.62026.6.6

References

Original description

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

Last activity 21 Oct 2026. Patch Forecast updates every hour.