OpenClaw versions up to 2026.4.1 have a vulnerability where remote CDP discovery can return a trailing-dot localhost host (e.g., 'localhost.') that bypasses loopback-host normalization. This allows a remote CDP profile to pivot connections back to the localhost interface, weakening loopback protections and potentially exposing localhost browser state. The issue is fixed in OpenClaw 2026.4.2.