CVE-2026-62197: OpenClaw CDP policy bypass reaches

CISO Take

OpenClaw, an AI browser-automation agent, enforces a network policy meant to block its Chrome DevTools Protocol (CDP) sessions from reaching certain destinations, but versions before 2026.6.6 fail to validate WebSocket URLs discovered during CDP session setup, letting an attacker with only low-privilege access to the agent bypass that blocklist and reach network destinations that were supposed to be off-limits. This is CVE-2026-62197, a CVSS 3.1 8.5 SSRF-class flaw (CWE-918) requiring no user interaction and only low privileges, with a scope change and high confidentiality impact — meaning a compromised or malicious low-trust caller can pivot through the agent's browser session into internal APIs, cloud metadata endpoints, or other network-segmented resources the policy was designed to protect. There's no public exploit or Nuclei template yet, it isn't in CISA KEV, and EPSS data isn't available, so opportunistic mass exploitation looks unlikely today — but the bug sits directly in the trust boundary of an agentic browser tool, which makes it attractive for targeted abuse in any environment where OpenClaw runs with network segmentation as a security control. Patch to OpenClaw 2026.6.6 or later immediately in any deployment that enables the affected CDP discovery feature; until patched, disable that feature or place OpenClaw's outbound CDP/WebSocket traffic behind an independent network-layer allowlist rather than relying on the built-in policy, and monitor CDP session logs for WebSocket connections to unexpected internal hosts.

Sources: NVD GitHub Advisory vulncheck.com ATLAS CISA KEV

What is the risk?

High risk in any environment that relies on OpenClaw's built-in network policy as a security boundary for its browser-automation/CDP feature. The flaw requires only low privileges and no user interaction (AC:L, PR:L, UI:N) to trigger, and the scope-changed, high-confidentiality CVSS profile (S:C/C:H) reflects that a successful bypass lets an attacker reach resources outside the OpenClaw sandbox itself — the core purpose of the policy being circumvented. Exploitability is currently constrained: no public PoC, no Nuclei template, not in CISA KEV, and EPSS is unavailable, so this looks like a disclosed-but-not-yet-weaponized SSRF-class bypass rather than an actively exploited one. Risk is elevated wherever OpenClaw is deployed multi-tenant or given access to internal/cloud networks, since 'lower-trust access' in the advisory implies the attacker doesn't need admin-level control of the agent to abuse this.

How does the attack unfold?

Entry via lower-trust access

An attacker with only low-privilege access to the OpenClaw deployment (e.g., a downstream caller or shared-tenant user) is able to trigger the agent's CDP session/discovery feature.

AML.T0053

Policy bypass

The CDP discovery logic fails to properly validate the WebSocket URL against OpenClaw's configured blocklist, accepting a connection to a destination that should have been blocked.

AML.T0107

Network pivot

Using the established CDP WebSocket session, the attacker reaches internal or otherwise segmented network destinations, such as internal APIs or cloud metadata endpoints.

AML.T0075

Impact

The attacker reads sensitive data or responses from the normally-blocked destination via the live browser/CDP session, resulting in a confidentiality breach beyond the OpenClaw sandbox's intended boundary.

Entry via lower-trust access

An attacker with only low-privilege access to the OpenClaw deployment (e.g., a downstream caller or shared-tenant user) is able to trigger the agent's CDP session/discovery feature.

AML.T0053

Policy bypass

The CDP discovery logic fails to properly validate the WebSocket URL against OpenClaw's configured blocklist, accepting a connection to a destination that should have been blocked.

AML.T0107

Network pivot

Using the established CDP WebSocket session, the attacker reaches internal or otherwise segmented network destinations, such as internal APIs or cloud metadata endpoints.

AML.T0075

Impact

The attacker reads sensitive data or responses from the normally-blocked destination via the live browser/CDP session, resulting in a confidentiality breach beyond the OpenClaw sandbox's intended boundary.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

Upgrade to OpenClaw 2026.6.6 or later, which fixes the WebSocket URL validation in CDP discovery. If immediate patching isn't possible, disable the affected CDP discovery feature until upgraded, or wrap OpenClaw's browser/CDP network egress in an independent network-layer control (firewall rules, egress proxy allowlist) rather than trusting the application-level policy alone. Audit any multi-tenant or shared OpenClaw deployment for callers with 'lower-trust access' and restrict who can trigger browser/CDP sessions. For detection, review CDP/WebSocket connection logs for destinations outside the intended allowlist — especially connections to internal IP ranges, localhost, or cloud metadata addresses (e.g., 169.254.169.254) — around the time this feature is invoked.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0075 - Cloud Service Discovery AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 2.3 - Mechanisms are in place to manage risks from AI system components and third-party resources

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-62197?

OpenClaw, an AI browser-automation agent, enforces a network policy meant to block its Chrome DevTools Protocol (CDP) sessions from reaching certain destinations, but versions before 2026.6.6 fail to validate WebSocket URLs discovered during CDP session setup, letting an attacker with only low-privilege access to the agent bypass that blocklist and reach network destinations that were supposed to be off-limits. This is CVE-2026-62197, a CVSS 3.1 8.5 SSRF-class flaw (CWE-918) requiring no user interaction and only low privileges, with a scope change and high confidentiality impact — meaning a compromised or malicious low-trust caller can pivot through the agent's browser session into internal APIs, cloud metadata endpoints, or other network-segmented resources the policy was designed to protect. There's no public exploit or Nuclei template yet, it isn't in CISA KEV, and EPSS data isn't available, so opportunistic mass exploitation looks unlikely today — but the bug sits directly in the trust boundary of an agentic browser tool, which makes it attractive for targeted abuse in any environment where OpenClaw runs with network segmentation as a security control. Patch to OpenClaw 2026.6.6 or later immediately in any deployment that enables the affected CDP discovery feature; until patched, disable that feature or place OpenClaw's outbound CDP/WebSocket traffic behind an independent network-layer allowlist rather than relying on the built-in policy, and monitor CDP session logs for WebSocket connections to unexpected internal hosts.

Is CVE-2026-62197 actively exploited?

No confirmed active exploitation of CVE-2026-62197 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62197?

Upgrade to OpenClaw 2026.6.6 or later, which fixes the WebSocket URL validation in CDP discovery. If immediate patching isn't possible, disable the affected CDP discovery feature until upgraded, or wrap OpenClaw's browser/CDP network egress in an independent network-layer control (firewall rules, egress proxy allowlist) rather than trusting the application-level policy alone. Audit any multi-tenant or shared OpenClaw deployment for callers with 'lower-trust access' and restrict who can trigger browser/CDP sessions. For detection, review CDP/WebSocket connection logs for destinations outside the intended allowlist — especially connections to internal IP ranges, localhost, or cloud metadata addresses (e.g., 169.254.169.254) — around the time this feature is invoked.

What systems are affected by CVE-2026-62197?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation / computer-use agents, multi-tenant AI agent deployments.

What is the CVSS score for CVE-2026-62197?

CVE-2026-62197 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation / computer-use agentsmulti-tenant AI agent deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0075 Cloud Service Discovery

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

Exploitation Scenario

A company runs OpenClaw as a shared browser-automation agent behind an internal gateway, giving a set of lower-privileged internal users or downstream services API access to trigger browser tasks, while the agent's network policy is configured to block CDP WebSocket connections to internal admin systems and the cloud metadata service. An attacker with only that lower-trust access — no admin rights on the OpenClaw deployment itself — crafts a CDP discovery request whose WebSocket URL matches a pattern the validation logic mishandles, causing OpenClaw to establish a CDP session to a destination that should have been blocked, such as an internal management API or the instance's cloud metadata endpoint. Through that live CDP/WebSocket channel the attacker can drive the browser or inspect its DevTools session to read back responses from the normally-blocked destination, exfiltrating internal API tokens, metadata credentials, or other sensitive data reachable only from inside the network perimeter the policy existed to protect.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.