GHSA-fh32-73r9-rgh5: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

April 7, 2026

Before OpenClaw 2026.4.2, remote CDP discovery could return a trailing-dot localhost host such as localhost. and bypass OpenClaw’s loopback-host normalization. That let a non-loopback remote CDP profile pivot the follow-up connection back onto localhost.

References

github.com/advisories/GHSA-fh32-73r9-rgh5
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/9c22d636697336a6b22b0ae24798d8b8325d7828
github.com/openclaw/openclaw/security/advisories/GHSA-fh32-73r9-rgh5

Code Behaviors & Features

Detect and mitigate GHSA-fh32-73r9-rgh5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →