Authorization Bypass in OpenClaw WebSocket Connections

CVE-2026-22172

What is CVE-2026-22172?

OpenClaw versions prior to 2026.3.12 are susceptible to an authorization bypass vulnerability within the WebSocket connection process. This flaw allows attackers to exploit shared-token or password-authenticated connections, enabling them to declare elevated scopes without the necessary server-side validation. As a result, unauthorized users can gain access to sensitive operations that are typically reserved for admin users, such as the 'operator.admin' scope. This logic flaw poses significant security risks, potentially allowing malicious actors to manipulate system operations and access sensitive data.

References