CVE Intelligence
Analysis AI-assisted

CVE-2026-22172: OpenClaw Scope Elevation in WebSocket Shared-Auth Connections

CVE-2026-22172 affects OpenClaw versions before 2026.3.12. The WebSocket connect path accepts scopes self-declared by clients that authenticate with a shared token or password, without server-side binding, which can allow admin-only gateway operations. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-22172 affects OpenClaw versions before 2026.3.12. According to the record description, the WebSocket connect path lets clients that authenticate with a shared token or password declare elevated scopes that the server does not bind to what those credentials allow. The weakness is classified as Missing Authorization (CWE-862).

Impact

  • According to the description, a client on such a connection can present elevated scopes such as operator.admin.
  • Those scopes may allow admin-only gateway operations.
  • VulnCheck assigns a critical CVSS base score of 9.9 with high confidentiality, integrity and availability impact.

Affected products and versions

  • Openclaw Openclaw: versions before 2026.3.12.
  • The record does not contain a separate fixed-version entry, so the upper boundary of the affected range is the only version reference available.

Exploitation status

CISA KEV does not list this CVE. The record's SSVC data shows exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade OpenClaw to 2026.3.12 or a later release, since the affected range ends at that version.
  • Until the upgrade is applied, limit network exposure of the gateway WebSocket interface.
  • Review which clients hold shared tokens or passwords and rotate those secrets if exposure is suspected.
  • Follow the vendor advisory for official guidance.

Detection guidance

  • Review gateway logs for WebSocket sessions using shared-secret authentication that carry administrative scopes.
  • Monitor for administrative gateway operations originating from unexpected clients or addresses.

Limitations of the available information

The record does not provide the full version history of the affected product, a detailed root-cause analysis, or information about the exact code change in the fix. The EPSS probability is about 0.57 percent, which reflects a low modeled likelihood of exploitation but does not confirm any activity.

Frequently asked questions

Which OpenClaw versions are affected by CVE-2026-22172?

The record lists OpenClaw versions before 2026.3.12 as affected. The advisory range therefore ends at 2026.3.12.

Is CVE-2026-22172 known to be exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

What is the main defensive step?

Upgrade OpenClaw to 2026.3.12 or later, limit exposure of the gateway WebSocket interface, and review shared credentials.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.