Description
OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.
Published: 2026-03-11
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenClaw versions 2026.2.21‑2 and @openclaw/voice‑call 2026.2.21 accept media‑stream WebSocket upgrades before the stream is validated. This allows unauthenticated clients to open connections that remain idle, consuming server resources. Remote attackers can keep these sockets open, depleting connection capacity and degrading availability for legitimate streams. The vulnerability is a resource exhaustion issue (CWE‑770).

Affected Systems

OpenClaw’s primary product, the OpenClaw platform, and its voice‑call component (openclaw:voice‑call) are affected. Versions 2026.2.21‑2 of the main application and 2026.2.21 of the voice‑call module are vulnerable; upgrading to version 2026.2.22 or later resolves the issue.

Risk and Exploitability

The CVSS base score of 8.7 classifies the issue as high severity, while the EPSS score of less than 1% indicates a relatively low likelihood of seeing an active exploitation. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers need not authenticate; any client able to reach the media‑stream WebSocket endpoint can abuse the flaw simply by opening and keeping the connection idle, making the attack vector likely to be network‑based.

Generated by OpenCVE AI on May 26, 2026 at 15:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.2.22 or newer.
  • Apply any vendor‑provided patches or updates released after the vulnerability is announced.
  • Configure network or reverse proxies to restrict WebSocket connections to authenticated clients only.
  • Monitor for unusual WebSocket activity and enforce connection limits.
  • Consult for additional mitigations.

Generated by OpenCVE AI on May 26, 2026 at 15:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-mfg5-7q5g-f37j OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
History

Tue, 26 May 2026 13:45:00 +0000

Type Values Removed Values Added
Description OpenClaw versions 2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams. OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.

Tue, 12 May 2026 02:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 12 May 2026 02:00:00 +0000

Type Values Removed Values Added
Description OpenClaw versions2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams. OpenClaw versions 2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.

Thu, 26 Mar 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Openclaw openclaw\/voice-call
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
cpe:2.3:a:openclaw:openclaw\/voice-call:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw openclaw\/voice-call

Thu, 12 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Openclaw voice-call
Vendors & Products Openclaw voice-call

Wed, 11 Mar 2026 13:45:00 +0000

Type Values Removed Values Added
Description OpenClaw versions2026.2.21-2 prior to 2026.2.22 and @openclaw/voice-call versions 2026.2.21 prior to 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.
Title OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-770
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*
cpe:2.3:a:openclaw:openclaw:2026.2.22:*:*:*:*:*:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw Openclaw\/voice-call Voice-call
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-26T11:52:09.941Z

Reserved: 2026-03-10T19:52:01.004Z

Link: CVE-2026-32062

cve-icon Vulnrichment

Updated: 2026-03-11T14:36:16.660Z

cve-icon NVD

Status : Modified

Published: 2026-03-11T14:16:28.340

Modified: 2026-05-26T14:16:32.280

Link: CVE-2026-32062

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-26T15:15:08Z

Weaknesses