Executive brief
OpenClaw is an open-source gateway/platform that handles WebSocket connections. An unauthenticated attacker can inject specially crafted HTTP headers into WebSocket requests that are logged without proper sanitization. If those logs are later reviewed or processed by an AI assistant (such as for debugging), the injected content could influence the AI's responses or actions, potentially leading to unintended behavior or security bypass (indirect prompt injection).
Technical details
The vulnerability is a log poisoning / indirect prompt injection (CWE-117) in OpenClaw's WebSocket gateway. When a WebSocket connection closes before completing the handshake, the gateway logs certain HTTP headers (Origin, User-Agent, and others) without neutralizing special characters or enforcing length limits. An unauthenticated, network-reachable attacker can send a WebSocket connection with crafted header values; those values are written unsanitized into core logs. The practical impact depends on downstream consumption: if logs are fed into LLM-based tools (e.g., AI-assisted debugging), injected content may alter model behavior. The fix (OpenClaw 2026.2.13 and later) sanitizes and truncates header values before logging, removing control/format characters and enforcing length limits.
Affected products
- OpenClaw OpenClaw <= 2026.2.12
Timeline
- 2026-02-17: disclosed
- 2026-02-13: patched: Fix merged in PR #15592