AI Threat AlertOpenClaw, an AI browser-automation agent, enforces a network policy meant to block its Chrome DevTools Protocol (CDP) sessions from reaching certain destinations, but versions before 2026.6.6 fail to validate WebSocket URLs discovered during CDP session setup, letting an attacker with only low-privilege access to the agent bypass that blocklist and reach network destinations that were supposed to be off-limits. This is CVE-2026-62197, a CVSS 3.1 8.5 SSRF-class flaw (CWE-918) requiring no user interaction and only low privileges, with a scope change and high confidentiality impact — meaning a compromised or malicious low-trust caller can pivot through the agent's browser session into internal APIs, cloud metadata endpoints, or other network-segmented resources the policy was designed to protect. There's no public exploit or Nuclei template yet, it isn't in CISA KEV, and EPSS data isn't available, so opportunistic mass exploitation looks unlikely today — but the bug sits directly in the trust boundary of an agentic browser tool, which makes it attractive for targeted abuse in any environment where OpenClaw runs with network segmentation as a security control. Patch to OpenClaw 2026.6.6 or later immediately in any deployment that enables the affected CDP discovery feature; until patched, disable that feature or place OpenClaw's outbound CDP/WebSocket traffic behind an independent network-layer allowlist rather than relying on the built-in policy, and monitor CDP session logs for WebSocket connections to unexpected internal hosts.
What is the risk?
High risk in any environment that relies on OpenClaw's built-in network policy as a security boundary for its browser-automation/CDP feature. The flaw requires only low privileges and no user interaction (AC:L, PR:L, UI:N) to trigger, and the scope-changed, high-confidentiality CVSS profile (S:C/C:H) reflects that a successful bypass lets an attacker reach resources outside the OpenClaw sandbox itself — the core purpose of the policy being circumvented. Exploitability is currently constrained: no public PoC, no Nuclei template, not in CISA KEV, and EPSS is unavailable, so this looks like a disclosed-but-not-yet-weaponized SSRF-class bypass rather than an actively exploited one. Risk is elevated wherever OpenClaw is deployed multi-tenant or given access to internal/cloud networks, since 'lower-trust access' in the advisory implies the attacker doesn't need admin-level control of the agent to abuse this.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade to OpenClaw 2026.6.6 or later, which fixes the WebSocket URL validation in CDP discovery. If immediate patching isn't possible, disable the affected CDP discovery feature until upgraded, or wrap OpenClaw's browser/CDP network egress in an independent network-layer control (firewall rules, egress proxy allowlist) rather than trusting the application-level policy alone. Audit any multi-tenant or shared OpenClaw deployment for callers with 'lower-trust access' and restrict who can trigger browser/CDP sessions. For detection, review CDP/WebSocket connection logs for destinations outside the intended allowlist — especially connections to internal IP ranges, localhost, or cloud metadata addresses (e.g., 169.254.169.254) — around the time this feature is invoked.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-62197?
OpenClaw, an AI browser-automation agent, enforces a network policy meant to block its Chrome DevTools Protocol (CDP) sessions from reaching certain destinations, but versions before 2026.6.6 fail to validate WebSocket URLs discovered during CDP session setup, letting an attacker with only low-privilege access to the agent bypass that blocklist and reach network destinations that were supposed to be off-limits. This is CVE-2026-62197, a CVSS 3.1 8.5 SSRF-class flaw (CWE-918) requiring no user interaction and only low privileges, with a scope change and high confidentiality impact — meaning a compromised or malicious low-trust caller can pivot through the agent's browser session into internal APIs, cloud metadata endpoints, or other network-segmented resources the policy was designed to protect. There's no public exploit or Nuclei template yet, it isn't in CISA KEV, and EPSS data isn't available, so opportunistic mass exploitation looks unlikely today — but the bug sits directly in the trust boundary of an agentic browser tool, which makes it attractive for targeted abuse in any environment where OpenClaw runs with network segmentation as a security control. Patch to OpenClaw 2026.6.6 or later immediately in any deployment that enables the affected CDP discovery feature; until patched, disable that feature or place OpenClaw's outbound CDP/WebSocket traffic behind an independent network-layer allowlist rather than relying on the built-in policy, and monitor CDP session logs for WebSocket connections to unexpected internal hosts.
Is CVE-2026-62197 actively exploited?
No confirmed active exploitation of CVE-2026-62197 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-62197?
Upgrade to OpenClaw 2026.6.6 or later, which fixes the WebSocket URL validation in CDP discovery. If immediate patching isn't possible, disable the affected CDP discovery feature until upgraded, or wrap OpenClaw's browser/CDP network egress in an independent network-layer control (firewall rules, egress proxy allowlist) rather than trusting the application-level policy alone. Audit any multi-tenant or shared OpenClaw deployment for callers with 'lower-trust access' and restrict who can trigger browser/CDP sessions. For detection, review CDP/WebSocket connection logs for destinations outside the intended allowlist — especially connections to internal IP ranges, localhost, or cloud metadata addresses (e.g., 169.254.169.254) — around the time this feature is invoked.
What systems are affected by CVE-2026-62197?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation / computer-use agents, multi-tenant AI agent deployments.
What is the CVSS score for CVE-2026-62197?
CVE-2026-62197 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.33%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0053AI Agent Tool InvocationAML.T0075Cloud Service DiscoveryAML.T0107Exploitation for Defense EvasionCompliance Controls Affected
What are the technical details?
Original Advisory
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.
Exploitation Scenario
A company runs OpenClaw as a shared browser-automation agent behind an internal gateway, giving a set of lower-privileged internal users or downstream services API access to trigger browser tasks, while the agent's network policy is configured to block CDP WebSocket connections to internal admin systems and the cloud metadata service. An attacker with only that lower-trust access — no admin rights on the OpenClaw deployment itself — crafts a CDP discovery request whose WebSocket URL matches a pattern the validation logic mishandles, causing OpenClaw to establish a CDP session to a destination that should have been blocked, such as an internal management API or the instance's cloud metadata endpoint. Through that live CDP/WebSocket channel the attacker can drive the browser or inspect its DevTools session to read back responses from the normally-blocked destination, exfiltrating internal API tokens, metadata credentials, or other sensitive data reachable only from inside the network perimeter the policy existed to protect.
Weaknesses (CWE)
CWE-284Improper Access ControlPrimaryCWE-918Server-Side Request ForgeryPrimaryCWE-918Server-Side Request Forgery (SSRF)PrimaryCWE-918Server-Side Request ForgeryCWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-221729.9OpenClaw: WebSocket scope self-elevation grants admin
Same package: openclawCVE-2026-335799.9OpenClaw: scope bypass escalates low-priv to admin
Same package: openclawCVE-2026-329229.9OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclawCVE-2026-307419.8OpenClaw: RCE via request-side prompt injection
Same package: openclawCVE-2026-538389.8OpenClaw: approval scope bypass via reconnection state
Same package: openclaw