GHSA-3x84-qq85-fj65: SSRF
Summary
Browser CDP discovery could accept blocked WebSocket URLs. In affected versions, a lower-trust caller or configured input path could reach network destinations that should have been blocked by OpenClaw policy.
This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.
Impact
When the affected feature is enabled and reachable, this could reach network destinations that should have been blocked by OpenClaw policy. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.
Patched Versions
The first stable patched version is 2026.6.6.
Mitigations
Upgrade to a patched OpenClaw release when one is listed. Before upgrading, restrict the affected feature to trusted operators or disable it when it is not needed. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.6.6 - Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.6.6 - Configuration
Disable Browser CDP discovery when it is not needed.
OpenClaw Browser CDP discovery affected feature = disabled - Compensating control
Before upgrading, restrict the affected feature to trusted operators; keep channel and tool allowlists narrow, and avoid sharing one Gateway between mutually untrusted users.
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments where Browser CDP discovery is enabled and reachable are exposed, particularly if lower-trust callers or configured input paths can reach it. Risk depends on the operator configuration and whether those inputs can invoke the affected path.
What access does an attacker need?
An attacker needs access through a lower-trust caller or configured input path that can reach the enabled Browser CDP discovery feature. Authenticated Gateway operators, installed plugins, and intentional local execution surfaces are considered trusted under the stated model unless another boundary is crossed.
What should be done before an upgrade is possible?
Restrict the affected feature to trusted operators or disable it if it is not needed. Keep channel and tool allowlists narrow and avoid sharing a Gateway between mutually untrusted users.
What version contains the fix?
The first stable patched OpenClaw version is 2026.6.6.