Description (CNA)
OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| openclaw / openclaw | affected 2026.2.21-2 before 2026.2.22; unaffected 2026.2.22 |
| openclaw / voice-call | affected 2026.2.21; unaffected 2026.2.22 |
CWE
CWE-770
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mfg5-7q5g-f37j
- https://github.com/openclaw/openclaw/commit/1d8968c8a821ff1a05c294a1846b3bcb6f343794
- https://www.vulncheck.com/advisories/openclaw-unauthenticated-websocket-resource-exhaustion-via-media-stream
ADP enrichment
No English description supplied.
No references supplied.