Unauthenticated WebSocket Resource Exhaustion in OpenClaw Media Stream
CVE-2026-32062

8.7HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Voice-call
Vendor
CVE Published:
11 March 2026

What is CVE-2026-32062?

Versions of OpenClaw prior to 2026.2.22 are susceptible to a resource exhaustion vulnerability due to improper validation of media-stream WebSocket upgrades. This flaw allows unauthenticated clients to connect and maintain idle pre-authenticated sockets, which can exhaust connection resources and impact the availability of legitimate streams. Attackers could exploit this vulnerability to hinder service performance, leading to a degraded experience for users.

Affected Version(s)

openclaw 2026.2.21-2 < 2026.2.22

voice-call 2026.2.21

voice-call 2026.2.22

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/1d8968c8a821f...
patch
https://www.vulncheck.com/advisories/openclaw-unauthentic...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@jiseoung
.