GHSA-pfv7-rr5m-qmv6 OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

Q: Which versions are affected by GHSA-pfv7-rr5m-qmv6?

2 open source packages ship an affected version, including openclaw.

Q: Is GHSA-pfv7-rr5m-qmv6 being exploited?

There is no known exploitation of GHSA-pfv7-rr5m-qmv6 in the wild and no public exploit code.

Q: How do I fix GHSA-pfv7-rr5m-qmv6?

Upgrade openclaw to 2026.2.19 or later.

Not scored Published 3 Mar 2026

Local attackers can bypass authentication on the OpenClaw extension relay endpoint if the feature is enabled, interfering with relay behavior.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is GHSA-pfv7-rr5m-qmv6?

GHSA-pfv7-rr5m-qmv6 is an authentication bypass vulnerability in openclaw, published on 3 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Summary

When the optional Chrome extension relay is enabled, /extension accepted unauthenticated WebSocket upgrades while /json/* and /cdp required auth.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.17
Latest published npm version at triage time: 2026.2.17

Impact

This is a local-only issue on loopback (127.0.0.1) and only applies when the extension relay feature is in use. A local process on the same machine could connect to /extension without the token and interfere with extension-relay behavior.

No remote network exploit path is involved.

Fix

Require gateway-token auth on both /extension and /cdp relay WebSocket endpoints.
Keep loopback/origin checks as defense-in-depth, not as authentication.
Use one token path in setup: gateway.auth.token / OPENCLAW_GATEWAY_TOKEN.

Fix Commit(s)

7e54b6c96feb1a5c30884f2b32037b8dadd0e532

OpenClaw thanks @tdjackey for reporting.

Which versions are affected by GHSA-pfv7-rr5m-qmv6?