CVE-2026-28458 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.1 contains a broken authentication vulnerability in the Browser Relay /cdp WebSocket endpoint that does not require authentication tokens, letting attackers steal session cookies and execute JavaScript in other tabs, exploit requires the extension to be installed and enabled.

Severity & Score

Impact

Attackers can steal session cookies and execute JavaScript in other browser tabs, leading to session hijacking and potential account compromise.

Mitigation

Update to version 2026.2.1 or later.

References

• https://github.com/openclaw/openclaw/commit/a1e89afcc19efd641c02b24d66d689f181ae2b5c
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mr32-vwc2-5j6h
• https://www.vulncheck.com/advisories/openclaw-missing-authentication-in-browser-relay-cdp-websocket-endpoint

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🟠 CVE-2026-28458 - High (7.5) OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopb... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28458/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner