CVE-2026-28395: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28395 is an improper network binding vulnerability in OpenClaw's Chrome extension relay server (ensureChromeExtensionRelayServer) that causes the relay HTTP/WebSocket server to bind to all network interfaces instead of only loopback when a wildcard cdpUrl (e.g., 0.0.0.0 or ::) is configured. Affected versions are OpenClaw (npm) >=2026.1.14-1 <2026.2.12. The vulnerability was published on March 5, 2026, and a patch was released on February 13, 2026 (version 2026.2.12). It carries a CVSS v3.1 base score of 9.1 (Critical) per NVD and a CVSS v4.0 base score of 6.3 (Medium) per the GitHub advisory (GitHub Advisory, Feedly).

The root cause is classified as CWE-1327 (Binding to an Unrestricted IP Address). The vulnerable code in extension-relay.ts incorrectly treated wildcard addresses (0.0.0.0, ::) as loopback-equivalent when evaluating the cdpUrl configuration parameter, causing the relay HTTP/WS server to listen on all network interfaces rather than restricting to localhost. Prior to the fix, the /json* endpoints and the /cdp WebSocket upgrade path lacked authentication, meaning any remote host that could reach the bound port could interact with the relay without credentials. The fix (commits 8d75a49 and a1e89af) centralized the isLoopbackHost utility to correctly exclude wildcard addresses, introduced a per-server random 32-byte auth token (x-openclaw-relay-token header) required for /json* HTTP endpoints and /cdp WebSocket upgrades, and added origin validation restricting WebSocket connections to chrome-extension:// origins (GitHub Commit a1e89af, GitHub Commit 8d75a49).

Remote, unauthenticated attackers who can reach the relay server's port can query relay HTTP endpoints to leak service presence and port information, enumerate connected Chrome extension targets, conduct denial-of-service attacks against the relay, and brute-force the relay token header. The vulnerability requires the OpenClaw Chrome extension to be installed and enabled, and a wildcard cdpUrl to be configured — but no authentication or user interaction is needed from the attacker's side. Successful exploitation could expose browser session data accessible through the Chrome DevTools Protocol (CDP) relay, potentially allowing an attacker to interact with or monitor browser tabs controlled by the relay (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.0018 (0.18%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target to have the OpenClaw Chrome extension installed and enabled, and the relay configured with a wildcard cdpUrl, which limits the attack surface (Feedly, GitHub Advisory).

1. Reconnaissance: Scan the network for hosts running OpenClaw with an open relay port (default or configured port) using tools like nmap or masscan. The relay server binds to all interfaces when a wildcard cdpUrl is set, making it discoverable from the network.
2. Probe relay endpoints: Send HTTP GET requests to /json/version or /json/list on the discovered port (e.g., curl http://<target-ip>:<port>/json/version). On unpatched versions, these endpoints respond without authentication, leaking service presence, port, and connected Chrome target information.
3. Enumerate targets: Parse the /json/list response to identify connected Chrome extension targets and their associated WebSocket debugger URLs exposed via the relay.
4. Conduct DoS or brute-force: Flood the relay with requests to exhaust resources (DoS), or systematically attempt to guess or brute-force the relay token header (x-openclaw-relay-token) to gain authenticated access to the /cdp WebSocket endpoint.
5. Interact via CDP: If the relay token is obtained or absent (pre-patch), connect to the /cdp WebSocket endpoint and issue Chrome DevTools Protocol commands to interact with or monitor browser tabs controlled by the relay (GitHub Advisory, GitHub Commit a1e89af).

• Network: Unexpected inbound HTTP/WebSocket connections to the OpenClaw relay port from non-loopback IP addresses; repeated requests to /json/version, /json/list, or /cdp endpoints from external hosts; high-volume or rapid sequential requests suggesting brute-force or DoS activity against the relay port.
• Logs: HTTP access log entries showing requests to /json* or /cdp paths originating from non-localhost IPs; 401 responses (post-patch) or 200 responses (pre-patch) to unauthenticated /json* requests from remote addresses; WebSocket upgrade attempts to /cdp without a valid x-openclaw-relay-token header.
• Process/Configuration: OpenClaw process listening on 0.0.0.0 or :: on the relay port (verifiable via netstat -tlnp or ss -tlnp); cdpUrl configuration containing a wildcard address.

Update OpenClaw (npm) to version 2026.2.12 or later, which was released on February 13, 2026, and includes the security fixes from commits 8d75a49 and a1e89af. If an immediate upgrade is not possible, disable or uninstall the Chrome extension to prevent the relay server from starting. As a network-level workaround, restrict access to the relay port using firewall rules to allow only trusted loopback or local connections. Avoid configuring cdpUrl with wildcard addresses (0.0.0.0, ::) in any environment where the host is network-accessible (GitHub Advisory, GitHub Commit a1e89af).

The vulnerability was reported by researcher @qi-scape and acknowledged in the GitHub Security Advisory published by steipete on February 14, 2026. No significant broader media coverage or notable social media commentary beyond the advisory and standard vulnerability database aggregation has been identified (GitHub Advisory).