CVE-2026-22174: OpenClaw local token leak

CISO Take

OpenClaw's Gateway component leaks its own authentication token by embedding it in Chrome DevTools Protocol reachability probes sent over the loopback interface, where any other local process can passively capture it and replay it as valid bearer credentials. This is a local-only, no-privileges, no-user-interaction flaw (CVSS 6.8, AV:L/PR:N/UI:N) with high confidentiality impact — a rogue process, malicious container, or another user on a shared host can fully impersonate the Gateway's authenticated caller. EPSS puts real-world exploitation probability very low today (0.00126) and CISA SSVC tags it TRACK, with no public exploit or Nuclei template yet, so this isn't a mass-exploitation risk — it's a chaining vector for anyone who already has a foothold on a machine running OpenClaw, especially shared dev boxes, CI runners, or multi-tenant sandboxes. OpenClaw's own track record (425 other CVEs in the same package, 0/100 internal risk score) suggests this is unlikely to be the last local trust-boundary issue in the product. Patch to OpenClaw 2026.2.22 or later immediately, and in the meantime treat any host running OpenClaw's Gateway as untrusted for co-tenancy — audit for unexpected local listeners on loopback CDP ports and rotate Gateway tokens post-upgrade.

Sources: NVD GitHub Advisory EPSS ATLAS VulnCheck CISA SSVC

What is the risk?

Medium overall (CVSS 6.8) but context-dependent: attack vector is strictly local (AV:L) with no privileges or user interaction required, and confidentiality impact is high because the leaked token grants full Gateway bearer authentication. Real-world exploitation likelihood is currently low — EPSS score 0.00126, no CISA KEV listing, no public PoC, no Nuclei template, and CISA SSVC assigns TRACK (monitor, not urgent). The realistic risk is as a privilege-escalation/lateral-movement chain link on hosts where OpenClaw already runs alongside untrusted code — shared workstations, CI runners, multi-tenant containers, or after an initial compromise via another vector (e.g., a malicious ClawHub skill, per AIID #1368). Given 425 historical CVEs in the OpenClaw package and a 0/100 internal package risk score, organizations should treat this as one data point in a broader pattern of weak trust boundaries rather than an isolated bug.

How does the attack unfold?

Local Reconnaissance

An attacker-controlled local process monitors loopback interface traffic while the OpenClaw Gateway performs its Chrome CDP reachability probes.

AML.T0006

Token Interception

The attacker captures the x-OpenClaw-relay-token header value sent in cleartext during CDP probe requests to Chrome's /json/version endpoint.

AML.T0055

Credential Reuse

The attacker replays the stolen token as a bearer credential to authenticate directly against the Gateway API.

AML.T0091.000

Unauthorized Agent Control

The attacker gains full authenticated access to invoke the AI agent's Gateway functions with no additional privileges or user interaction required.

AML.T0053

Local Reconnaissance

An attacker-controlled local process monitors loopback interface traffic while the OpenClaw Gateway performs its Chrome CDP reachability probes.

AML.T0006

Token Interception

The attacker captures the x-OpenClaw-relay-token header value sent in cleartext during CDP probe requests to Chrome's /json/version endpoint.

AML.T0055

Credential Reuse

The attacker replays the stolen token as a bearer credential to authenticate directly against the Gateway API.

AML.T0091.000

Unauthorized Agent Control

The attacker gains full authenticated access to invoke the AI agent's Gateway functions with no additional privileges or user interaction required.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR None

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

Patch: upgrade OpenClaw to version 2026.2.22 or later, which removes the token from CDP probe traffic (see commit afa22ac and GHSA-v3j7-34xh-6g3w). Workaround if patching is delayed: avoid running OpenClaw's Gateway on shared/multi-tenant hosts or containers where untrusted local processes or users have loopback access; isolate the Gateway in its own network namespace or VM. Rotate/regenerate Gateway tokens immediately after upgrading, since any token issued pre-patch should be considered potentially exposed. Detection: monitor for unexpected local processes binding to or sniffing loopback ports used for CDP, and audit Gateway API access logs for authenticated calls from unexpected source processes or patterns inconsistent with the legitimate agent's behavior.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security and access control

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-22174?

OpenClaw's Gateway component leaks its own authentication token by embedding it in Chrome DevTools Protocol reachability probes sent over the loopback interface, where any other local process can passively capture it and replay it as valid bearer credentials. This is a local-only, no-privileges, no-user-interaction flaw (CVSS 6.8, AV:L/PR:N/UI:N) with high confidentiality impact — a rogue process, malicious container, or another user on a shared host can fully impersonate the Gateway's authenticated caller. EPSS puts real-world exploitation probability very low today (0.00126) and CISA SSVC tags it TRACK, with no public exploit or Nuclei template yet, so this isn't a mass-exploitation risk — it's a chaining vector for anyone who already has a foothold on a machine running OpenClaw, especially shared dev boxes, CI runners, or multi-tenant sandboxes. OpenClaw's own track record (425 other CVEs in the same package, 0/100 internal risk score) suggests this is unlikely to be the last local trust-boundary issue in the product. Patch to OpenClaw 2026.2.22 or later immediately, and in the meantime treat any host running OpenClaw's Gateway as untrusted for co-tenancy — audit for unexpected local listeners on loopback CDP ports and rotate Gateway tokens post-upgrade.

Is CVE-2026-22174 actively exploited?

No confirmed active exploitation of CVE-2026-22174 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22174?

Patch: upgrade OpenClaw to version 2026.2.22 or later, which removes the token from CDP probe traffic (see commit afa22ac and GHSA-v3j7-34xh-6g3w). Workaround if patching is delayed: avoid running OpenClaw's Gateway on shared/multi-tenant hosts or containers where untrusted local processes or users have loopback access; isolate the Gateway in its own network namespace or VM. Rotate/regenerate Gateway tokens immediately after upgrading, since any token issued pre-patch should be considered potentially exposed. Detection: monitor for unexpected local processes binding to or sniffing loopback ports used for CDP, and audit Gateway API access logs for authenticated calls from unexpected source processes or patterns inconsistent with the legitimate agent's behavior.

What systems are affected by CVE-2026-22174?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser-based AI agents / computer-use automation.

What is the CVSS score for CVE-2026-22174?

CVE-2026-22174 has a CVSS v3.1 base score of 6.8 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser-based AI agents / computer-use automation

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token. An attacker controlling a loopback port can intercept CDP reachability probes to the /json/version endpoint and reuse the leaked token as Gateway bearer authentication.

Exploitation Scenario

A shared host or CI runner runs OpenClaw's agent framework, which uses the Chrome DevTools Protocol to drive an automated browser. When the Gateway performs a reachability probe against Chrome's /json/version endpoint, it includes the x-OpenClaw-relay-token header. A local attacker-controlled process — another user account, a co-tenant container, or malware that already has a minimal foothold — passively observes loopback traffic and captures this token. The attacker then replays the stolen token as a bearer credential directly against the Gateway API, gaining full authenticated access to the agent's Gateway functions without needing any additional privileges, exploitation chain, or user interaction.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.