GHSA-pfv7-rr5m-qmv6: OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

March 3, 2026

When the optional Chrome extension relay is enabled, /extension accepted unauthenticated WebSocket upgrades while /json/* and /cdp required auth.

References

github.com/advisories/GHSA-pfv7-rr5m-qmv6
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/7e54b6c96feb1a5c30884f2b32037b8dadd0e532
github.com/openclaw/openclaw/security/advisories/GHSA-pfv7-rr5m-qmv6

Code Behaviors & Features

Detect and mitigate GHSA-pfv7-rr5m-qmv6 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →