PT-2026-26406 · Openclaw · Openclaw
Luz-Oasis
·
Publicado
2026-03-03
·
Atualizado
2026-03-20
·
CVE-2026-32025
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.25
Description
OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients. This allows attackers to bypass origin checks and authentication throttling in loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-force attacks against the gateway to establish an authenticated operator session and invoke control-plane methods. Successful exploitation requires the gateway to be reachable on loopback, password authentication to be in use, and the victim to open attacker-controlled web content with a guessable password. The issue involves origin checks not being enforced for some WebSocket client IDs, loopback authentication attempts being exempt from password-failure throttling, and a silent local pairing path available to browser-origin clients. Exploitation allows an attacker to invoke control-plane methods available to the operator role.
Recommendations
Update to OpenClaw version 2026.2.25 or later.
Enforce browser-origin checks for direct browser WebSocket clients.
Apply browser-origin authentication failure throttling with loopback exemption disabled.
Block silent auto-pairing for non-Control-UI browser-origin clients.
Correção
Improper Restriction of Excessive Authentication Attempts
Improper Authentication
Origin Validation Error
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openclaw