Openclaw cli: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections (CVE-2026-41372)

Before OpenClaw 2026.4.2, remote Chrome DevTools Protocol (CDP) discovery could return a trailing-dot localhost host such as 'localhost.' which bypassed OpenClaw's loopback-host normalization checks. This flaw allowed a non-loopback remote CDP profile to pivot the follow-up connection back onto the localhost interface, weakening the intended remote-CDP loopback protection. The vulnerability could expose browser state backed by localhost endpoints. The issue affects openclaw-cli versions >=2026.1.29 and <2026.4.2 and was fixed by normalizing localhost absolute-form CDP hosts before loopback checks in commit 9c22d636697336a6b22b0ae24798d8b8325d7828.

An attacker controlling a hostile discovery response could redirect authenticated browser control to a localhost-resolving endpoint on the OpenClaw host. This bypasses the loopback protections designed to prevent remote CDP profiles from accessing localhost resources, potentially exposing sensitive browser state associated with localhost endpoints. The impact is limited to information disclosure of localhost-backed browser state without direct integrity or availability impact.

A fix is available and included starting with OpenClaw version 2026.4.2. Users should upgrade to version 2026.4.2 or later to ensure loopback-host normalization correctly handles trailing-dot localhost CDP hosts and prevents bypass of remote loopback protections.