CVE-2026-62197 with a CVSS score of 6.3 is a policy-bypass vulnerability in the OpenClaw Browser CDP discovery feature. The flaw allows the component to accept WebSocket URLs that should have been blocked by OpenClaw policy, creating an improper access-control weakness in the discovery path. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can use the network-based attack surface to reach network destinations that are supposed to be denied. The condition requires that lower-trust input can reach the affected path, and practical impact depends on operator configuration. The business impact is that security boundaries and allowlist controls can be bypassed, allowing disallowed network connections and potentially exposing sensitive systems, data, or internal endpoints to lower-trust actors. This weakens the intended trusted-operator model and can increase the risk of unauthorized access, data leakage, or operational disruption in environments where the feature is exposed to untrusted input.
We recommend you to update openclaw to version 2026.6.6 or later.[/subscribe_to_unlock_form]
CVE-2026-62197 with a CVSS score of 6.3 is a policy-bypass vulnerability in the OpenClaw Browser CDP discovery feature. The flaw allows the component to accept WebSocket URLs that should have been blocked by OpenClaw policy, creating an improper access-control weakness in the discovery path. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can use the network-based attack surface to reach network destinations that are supposed to be denied. The condition requires that lower-trust input can reach the affected path, and practical impact depends on operator configuration. The business impact is that security boundaries and allowlist controls can be bypassed, allowing disallowed network connections and potentially exposing sensitive systems, data, or internal endpoints to lower-trust actors. This weakens the intended trusted-operator model and can increase the risk of unauthorized access, data leakage, or operational disruption in environments where the feature is exposed to untrusted input.
We recommend you to update openclaw to version 2026.6.6 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]