Openclaw cli: OpenClaw: Browser debug/export routes could reuse already-open blocked tabs (CVE-2026-35673)

CVE-2026-35673 describes a vulnerability in OpenClaw CLI where browser debug/export routes can reuse already-open blocked tabs, bypassing the expected Server-Side Request Forgery (SSRF) policy enforcement. This flaw allows a caller referencing an existing browser tab to access private-network tabs that should remain blocked by network policies. The vulnerability is scoped to the named feature and does not alter the trusted-operator model of OpenClaw. The issue is present in versions >=2026.1.29 and <2026.4.29 and has been addressed in version 2026.4.29.

If the affected feature is enabled and accessible, an attacker or lower-trust input could export or inspect content from tabs that should be protected by browser network policies, potentially leading to unauthorized data exposure. The actual impact depends on the operator's configuration and whether untrusted inputs can reach the vulnerable code path.

A patch is available in OpenClaw CLI version 2026.4.29. Until systems are updated, operators should close blocked tabs before using debug/export features and restrict access to browser debug routes. Additionally, it is recommended to keep channel and tool allowlists narrow, avoid sharing a Gateway between mutually untrusted users, and disable the affected feature when not needed.