CVE-2026-41372: OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery

Severity: medium (CVSS 5.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-28 · updated 2026-07-24
Weakness: CWE-639

Description

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.

Affected products

OpenClaw: before 2026.4.2 — fixed in 2026.4.2

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.2. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/9c22d636697336a6b22b0ae24798d8b8325d7828
https://github.com/openclaw/openclaw/security/advisories/GHSA-fh32-73r9-rgh5
https://www.vulncheck.com/advisories/openclaw-loopback-protection-bypass-via-trailing-dot-localhost-in-cdp-discovery

Get alerted when CVE-2026-41372 or the next vulnerability affects your stack