Executive brief
OpenClaw is a Node.js framework that manages distributed agent workflows and voice services. A flaw in its WebSocket authentication allows clients holding only a shared gateway token to impersonate node devices and trigger unauthorized agent execution and voice transcript processing, potentially enabling attackers to execute arbitrary workflows without proper device pairing.
Technical details
The vulnerability is an authorization bypass (CWE-863) in OpenClaw's WebSocket connect path. The flaw allows a client authenticated with a shared gateway token to claim the role=node without possessing proper device identity/pairing credentials, bypassing the device-less authentication check. Once connected as a node role, the attacker can invoke the node.event API (which is role-restricted to nodes) to inject events that trigger agent.request and voice.transcript flows. The attack requires network access to the WebSocket endpoint and knowledge of the shared gateway token, but no additional user interaction or higher privileges. The vulnerability affects OpenClaw versions up to 2026.2.21-2; the fix in version 2026.2.22 enforces mandatory device identity validation for role=node connections regardless of shared-token authentication success.
Affected products
- OpenClaw openclaw <= 2026.2.21-2
Timeline
- 2026-03-03: disclosed: Published on GitHub Security Advisory
- 2026-02-23: patched: Fix planned for version 2026.2.22