CVE-2026-22172
CVE-2026-22172 · OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.
CVSS 9.4 · Crítica · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node