Authorization Bypass in OpenClaw WebSocket Connections

CVE-2026-22172

What is CVE-2026-22172?

OpenClaw versions prior to 2026.3.12 are susceptible to an authorization bypass vulnerability within the WebSocket connection process. This flaw allows attackers to exploit shared-token or password-authenticated connections, enabling them to declare elevated scopes without the necessary server-side validation. As a result, unauthorized users can gain access to sensitive operations that are typically reserved for admin users, such as the 'operator.admin' scope. This logic flaw poses significant security risks, potentially allowing malicious actors to manipulate system operations and access sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References