high8.5
CVE-2026-62197
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs.
Impact
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | < 2026.6.6 | 2026.6.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.6.6 |