Vulnerability Description
OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token. An attacker controlling a loopback port can intercept CDP reachability probes to the /json/version endpoint and reuse the leaked token as Gateway bearer authentication.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.2.22 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/afa22acc4a09fdf32be8a167ae216bee85c3Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-v3j7-34xh-6g3wVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-gateway-token-disclosure-via-chromThird Party Advisory
FAQ
What is CVE-2026-22174?
CVE-2026-22174 is a vulnerability with a CVSS score of 6.8 (MEDIUM). OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loopback interfaces, allowing local processes to capture the Gateway authentication token...
How severe is CVE-2026-22174?
CVE-2026-22174 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22174?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.