Description
OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.3.12 | 2026.3.12 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.3.12 | 2026.3.12 | GHSA-rqpp-rjj8-7wv8 |
Advisories 1
- WID-SEC-2026-0727 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 31, 2026
References
- GitHub Security Advisory (GHSA-rqpp-rjj8-7wv8) vendor-advisory
- https://www.vulncheck.com/advisories/openclaw-scope-elevation-in-websocket-shared-auth-connections third-party-advisory