Untriaged
Permalink
CVE-2026-22172
9.9 CRITICAL
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections
OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.
References
- GitHub Security Advisory (GHSA-rqpp-rjj8-7wv8) vendor-advisory
- https://www.vulncheck.com/advisories/openclaw-scope-elevation-in-websocket-shar… third-party-advisory
Affected products
OpenClaw
- ==2026.3.12
- <2026.3.12
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>