OpenClaw before version 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without allocating a pre‑authentication budget. This flaw allows attackers who can reach the WebSocket endpoint over the network to open a large number of upgrade requests, exhausting socket and worker capacity. As a result, legitimate clients lose availability of the WebSocket service. The weakness is a classic example of unbounded resource allocation (CWE-770).

The vulnerability affects all OpenClaw installations running versions earlier than 2026.3.28. The product was identified by the CNA as "OpenClaw:OpenClaw" and is implemented in a Node.js environment. No other versions or product variants are listed as affected.

The CVSS score of 8.7 indicates a high severity and the lack of a pre‑authentication budget increases both the attack surface and the potential impact. While the EPSS score is not available, the absence of this metric does not diminish the high impact of the flaw. The vulnerability is not listed in the CISA KEV catalog, but its high CVSS rating and the fact that attackers can trigger it from the network without authentication make it highly actionable. Attackers would target the WebSocket endpoint to launch a denial of Service by flooding the server with upgrade requests, leading to legitimate client disconnection or degraded service.