OpenClaw GHSA-mr32-vwc2-5j6h (High): Missing Authentication on CDP WebSocket — Patch to 2026.2.21-1 Now
If you’re running OpenClaw and haven’t patched to 2026.2.21-1 yet, stop what you’re doing. There’s a high-severity vulnerability — GHSA-mr32-vwc2-5j6h — that you need to know about. What’s the Vulnerability? The flaw lives in OpenClaw’s Browser Relay: specifically, the /cdp WebSocket endpoint that powers browser control features. Prior to the patch, this endpoint had no authentication token requirement. That means any process running locally — or any attacker who can reach your machine — could connect to the CDP WebSocket without proving who they are. ...