Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-qw99-grcx-4pvm
Advisory ID github_osv/GHSA-qw99-grcx-4pvm
Aliases CVE-2026-28395
Summary OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback ## Summary The Chrome extension relay (`ensureChromeExtensionRelayServer`) previously treated wildcard hosts (`0.0.0.0` / `::`) as loopback, which could make it bind the relay HTTP/WS server to all interfaces when a wildcard `cdpUrl` was passed. ## Impact If configured with a wildcard `cdpUrl`, relay HTTP endpoints could become reachable off-host, leaking service presence/port and enabling DoS/brute-force traffic against the relay token header. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `>= 2026.1.14-1 < 2026.2.12` ## Fixed Versions - Patched: `>= 2026.2.12` (released 2026-02-13) ## Fix Commit(s) - 8d75a496bf5aaab1755c56cf48502d967c75a1d0 ## Notes - Earlier hardening for `/json*` auth and `/cdp` token checks landed in: - a1e89afcc19efd641c02b24d66d689f181ae2b5c Thanks @qi-scape for reporting.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-284 Improper Access Control
CWE-1327 Binding to an Unrestricted IP Address
System Score Found at
cvssv3.1 6.5 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qw99-grcx-4pvm/GHSA-qw99-grcx-4pvm.json
cvssv4 6.3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qw99-grcx-4pvm/GHSA-qw99-grcx-4pvm.json
generic_textual MODERATE
Reference id Reference type URL
https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/commit/8d75a496bf5aaab1755c56cf48502d967c75a1d0
https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c
https://github.com/openclaw/openclaw/releases/tag/v2026.2.12
https://www.vulncheck.com/advisories/openclaw-unintended-public-binding-of-chrome-extension-relay-via-wildcard-cdpurl
CVE-2026-28395 https://nvd.nist.gov/vuln/detail/CVE-2026-28395
GHSA-qw99-grcx-4pvm https://github.com/openclaw/openclaw/security/advisories/GHSA-qw99-grcx-4pvm
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qw99-grcx-4pvm/GHSA-qw99-grcx-4pvm.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-qw99-grcx-4pvm/GHSA-qw99-grcx-4pvm.json
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-11T13:38:02Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/28xxx/CVE-2026-28395.json

Source Advisory: vulnrichment/CVE-2026-28395

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]