Executive brief
OpenClaw is a platform that provides gateway services for WebSocket communication. An unauthenticated attacker on the network can exploit a flaw in how the gateway handles WebSocket connection requests before authenticating users, allowing them to consume server resources and disrupt service availability for legitimate users.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400, CWE-770) in the OpenClaw gateway's WebSocket upgrade handler. The gateway failed to enforce limits on concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget. An unauthenticated network attacker could send unlimited concurrent WebSocket upgrade requests to exhaust socket and worker capacity, causing denial of service for legitimate authenticated clients. The fix involved capping concurrent pre-auth WebSocket upgrades, releasing pre-auth budget on failed upgrades, and scoping pre-auth budgets to trusted client IP addresses (commit cb5f7e201f). Versions through 2026.3.24 are affected; version 2026.3.28 and later contain the fix.
Affected products
- OpenClaw OpenClaw <= 2026.3.24
Timeline
- 2026-03-31: disclosed
- 2026-03-28: patched: Version 2026.3.28 contains the fix