Advisory details:
gitlab / npm/openclaw/GHSA-mr32-vwc2-5j6h
| Advisory ID | gitlab/npm/openclaw/GHSA-mr32-vwc2-5j6h |
| Aliases |
GHSA-mr32-vwc2-5j6h
|
| Summary | OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access In affected versions, the Browser Relay `/cdp` WebSocket endpoint did not require an authentication token. As a result, a website running in the browser could potentially connect to the local relay (via loopback WebSocket) and use CDP to access cookies from other open tabs and run JavaScript in the context of other tabs. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-mr32-vwc2-5j6h.yml |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/openclaw/openclaw | ||
| https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c | ||
| https://github.com/openclaw/openclaw/releases/tag/v2026.2.1 | ||
| GHSA-mr32-vwc2-5j6h | https://github.com/advisories/GHSA-mr32-vwc2-5j6h | |
| GHSA-mr32-vwc2-5j6h | https://github.com/openclaw/openclaw/security/advisories/GHSA-mr32-vwc2-5j6h |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.