CVE-2026-22172
published 2026-03-20CVE-2026-22172: OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or…
PriorityP268critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.51%
39.3th percentile
OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openclaw | openclaw | < 2026.3.12 | 2026.3.12 |
| openclaw | openclaw | >= 0 < 2026.3.12 | 2026.3.12 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect WebSocket CONNECT messages where a shared-token or password-authenticated client self-declares elevated scopes such as 'operator.admin' without server-side scope binding ↗
- →Monitor WebSocket connect path traffic for scope claims of 'operator.admin' originating from non-privileged (shared-token or password-authenticated) sessions ↗
- ·Vulnerability affects OpenClaw (formerly Moltbot or Clawdbt) versions prior to 2026.3.12; fix is available — upgrade to 2026.3.12 or later to remediate the authorization bypass in the WebSocket connect path ↗
- ·The vulnerability exists specifically in the WebSocket connect path's scope-binding logic; server-side scope validation must be enforced and not rely on client-declared scope values ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
osv·2026-03-13
CVE-2026-22172 [CRITICAL] OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
### Summary
A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as `operator.admin` even though those scopes were not tied to a device identity or an explicitly trusted Control UI path.
### Impact
This crossed the intended authorization boundary and could let a shared-secret-authenticated backend client perform admin-only gateway operations.
### Affected versions
`openclaw` `<= 2026.3.11`
### Patch
Fixed in `openclaw` `2026.3.12`. The gateway now clears unbound scopes for non-Control-UI s
GHSA
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
ghsa·2026-03-13
CVE-2026-22172 [CRITICAL] CWE-269 OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
### Summary
A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as `operator.admin` even though those scopes were not tied to a device identity or an explicitly trusted Control UI path.
### Impact
This crossed the intended authorization boundary and could let a shared-secret-authenticated backend client perform admin-only gateway operations.
### Affected versions
`openclaw` `<= 2026.3.11`
### Patch
Fixed in `openclaw` `2026.3.12`. The gateway now clears unbound scopes for non-Control-UI s
No detection rules found.
No public exploits indexed.
2026-03-20
Published