EUVD-2026-87492
GHSA-5m65-2pj9-qf79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Gateway listener over network
-
DeliverySend malformed WebSocket upgrade requests
-
ExploitServer retains response sockets
-
ExecutionRepeat, bypassing pre-auth budget
-
PersistExhaust listener resources
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the OpenClaw Gateway listener (the WebSocket-accepting endpoint) on an instance running a version before 2026.8.1. No authentication and no user interaction are needed (PR:N/UI:N). The critical enabling factor is that malformed upgrade requests retain response sockets while bypassing the WebSocket pre-auth connection budget, so the product's built-in connection-limiting does not throttle the attack. Limiting factors: the Gateway listener must be exposed to the attacker's network, and impact is confined to availability - no data disclosure or code execution results. |
| Impact | This is a genuine but bounded availability risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes an unauthenticated, low-complexity, network-reachable denial of service with no confidentiality or integrity impact - consistent with the CWE-400 resource-exhaustion classification and the description's socket-retention mechanism. The vendor's 8.7 (High) score is somewhat generous for a pure availability flaw; under CVSS 3.1 the same facts map to roughly 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so exploitation is unconfirmed. The distinguishing detail - that the attack bypasses the WebSocket pre-auth connection budget - means the product's own rate-limiting mitigation does not apply, which raises real-world exploitability for anyone able to reach the Gateway listener. Net: a real DoS worth patching, but not a widespread emergency given the niche product footprint and absence of exploitation signals. |
| Exploit ScenarioDerived | An attacker with network reach to the OpenClaw Gateway listener repeatedly opens connections and sends malformed WebSocket upgrade requests that lack matching connection semantics, causing the server to retain the response sockets rather than closing them. Because these requests do not consume the WebSocket pre-auth connection budget, the attacker can accumulate held sockets until listener resources are exhausted and legitimate clients can no longer connect. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Resource exhaustion in the OpenClaw Gateway listener affects every OpenClaw release before 2026.8.1 and lets unauthenticated remote attackers open WebSocket upgrade requests that retain response sockets without matching connection semantics; repeated malformed upgrade requests drain listener capacity until the service becomes unavailable (CVSS 4.0 8.7, availability-only; independent assessment rates A:H with PR:N/UI:N). Because those requests sidestep the product's WebSocket pre-auth connection budget, the built-in connection limiting does not throttle the flood, and the only prerequisites are network reachability to the Gateway listener - no credentials and no user interaction. No public exploit code has been identified at time of analysis, and impact is confined to availability, with no data disclosure or code execution reported.
RemediationAI
Vendor-released patch: OpenClaw 2026.8.1, which is the first fixed version; upgrading to 2026.8.1 or later is the primary remediation, as documented in GHSA-4r25-35qc-fr6j and the VulnCheck advisory. Where the upgrade cannot be applied immediately, the highest-value compensating control is to remove network reachability by binding the Gateway listener to a loopback or private interface and restricting access with firewall allow-lists or an authenticated reverse proxy, accepting that this breaks legitimate remote clients. Fronting the Gateway with a proxy that enforces hard per-IP connection and request-rate limits, short header and read timeouts, and validation that rejects WebSocket upgrade requests lacking a consistent Connection: Upgrade and Upgrade: websocket pair before they reach OpenClaw will blunt the flood, but it leaves the underlying socket-accounting defect in place and requires the proxy to be sized and tuned so it does not itself become the bottleneck. As a stopgap, monitor Gateway socket and connection counts and periodically recycle the listener or reclaim stuck sockets, which restores service at the cost of brief interruptions and does not prevent re-exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the OpenClaw Gateway, a network listener that accepts HTTP connections and performs WebSocket upgrade handshakes, typically for agent or client streaming traffic. The flaw maps to CWE-400 (Uncontrolled Resource Consumption): the listener tracks outstanding WebSocket handshakes against a pre-authentication connection budget, but requests that present upgrade headers without matching connection semantics leave the underlying response socket retained without being counted against that budget. Each such request therefore consumes a listener resource such as a socket, buffer and worker slot while escaping the control intended to bound it, so a continuous stream of malformed upgrades monotonically depletes listener capacity. The CPE record cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* is version-agnostic, consistent with an advisory scope covering all builds prior to 2026.8.1. There is no confidentiality or integrity component: nothing is read, modified or executed, and the attack is purely a state and resource-accounting defect exploited to exhaust availability.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated, low-complexity network requests to the listener (AV:N/AC:L/PR:N/UI:N) cause availability-only impact (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.
Articles & Coverage 1
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption), with the advisory also tagging CWE-404 (Improper Resource Shutdown or Release).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw Gateway versions prior to 2026.8.1 are vulnerable to an unauthenticated remote denial-of-service condition that can exhaust listener capacity and render the service unavailable. Because no credentials or user interaction are required, any attacker with network access to the Gateway listener can repeatedly disrupt availability, potentially causing operational downtime and impacting customers or internal users until a patch or mitigation is deployed. No public exploit identified at time of analysis, but the lack of a vendor patch heightens the need for immediate compensating controls.
Restrict network access to the OpenClaw Gateway listener to trusted sources; deploy a reverse proxy or WAF to throttle WebSocket upgrade requests and enforce connection limits; enable logging and alerting for repeated malformed upgrade attempts; consider temporarily disabling the Gateway listener if not essential.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB