Openclaw cli: OpenClaw Loopback CDP probe can leak Gateway token to local listener (CVE-2026-22174)

OpenClaw CLI versions <= 2026.2.21-2 inject the 'x-openclaw-relay-token' header containing the Gateway authentication token into Chrome DevTools Protocol (CDP) loopback probe requests to '/json/version'. If an attacker controls the local loopback port being probed, they can capture this token and reuse it as a bearer token to authenticate to the Gateway. The vulnerability is due to the injection of authentication headers in loopback CDP URLs and affects local processes on the same machine. The issue is fixed in version 2026.2.22. This does not affect standard single-owner installs but poses a risk in shared-user or shared-host setups where untrusted local processes can bind the loopback relay port.

Local attackers with the ability to control or race for the loopback relay port can capture the OpenClaw Gateway authentication token, resulting in local credential disclosure. The attacker can then reuse the token to authenticate to the Gateway, potentially gaining unauthorized access depending on Gateway capabilities and deployment configuration. This vulnerability does not affect remote attackers or standard single-owner environments where local process trust boundaries are maintained.

A patch is available and should be applied by upgrading openclaw-cli to version 2026.2.22 or later. This update removes the injection of the authentication token into loopback CDP probe requests, preventing local token leakage. For environments with shared users or shared hosts, applying the patch is critical to mitigate the risk. Standard single-owner installs do not require additional action as the vulnerability does not change the documented security model.