Loopback Protection Bypass in OpenClaw by OpenClaw

CVE-2026-41372

What is CVE-2026-41372?

OpenClaw versions prior to 2026.4.2 are susceptible to a vulnerability that fails to properly normalize localhost hosts with trailing dots in remote CDP discovery responses. This failure allows attackers to craft malicious discovery responses returning trailing-dot localhost, effectively bypassing loopback protections. Consequently, this could enable attackers to redirect authenticated browser controls towards local endpoints, jeopardizing the security of browser state and exposing sensitive user data.

References