CVE-2026-22172: OpenClaw: WebSocket scope self-elevation grants admin

CRITICAL

Published March 20, 2026

CISO Take

CVE-2026-22172 is a missing-authorization flaw in OpenClaw's WebSocket connect path: a client authenticated with only a shared token or password can simply declare elevated scopes such as operator.admin, and the server accepts them without binding. That turns any low-privilege credential into full gateway control, and the CVSS 9.9 with scope change reflects the exposure of whatever the agent can reach (tools, credentials, connected inboxes and hosts). Near-term exploitation pressure looks moderate rather than urgent: EPSS is 0.56% (top 55%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. Still, the flaw is trivial to abuse once someone holds any valid shared secret, and OpenClaw has already been targeted in the wild (AIID #1368 skills ecosystem abuse, AIID #1646 agent-driven government intrusions). Upgrade to OpenClaw 2026.3.12 or later, rotate all shared tokens and passwords, and review gateway logs for admin-only operations performed by non-admin identities.

Sources:NVDEPSSGitHub Advisoryvulncheck.comATLASAIID

What is the risk?

Rated critical (CVSS 3.1 9.9: network, low complexity, low privileges, no user interaction, scope changed, high C/I/A). Exploitation requires a valid shared-token or password connection, so the barrier is possession of any low-privilege credential, which is often widely distributed to teams, integrations or leaked in configs. Current exploitation likelihood is low-to-moderate (EPSS 0.00561, top 55%; not in KEV; no public PoC or scanner template; SSVC TRACK). Blast radius for direct dependents is small (3 downstream dependents), but impact per deployment is high because the gateway fronts agent tools and credentials. Confidence: HIGH on the flaw description (vendor advisory GHSA-rqpp-rjj8-7wv8 and VulnCheck), MEDIUM on real-world exploitation likelihood given the absence of exploit telemetry.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege shared token or password and opens a WebSocket connection to the OpenClaw gateway.

AML.T0012

Privilege Escalation

Connect request self-declares operator.admin scope, which the server accepts without server-side binding.

AML.T0049

Admin Operations

Attacker performs admin-only gateway operations such as changing agent configuration, tools or sessions.

AML.T0053

Impact

Attacker abuses the agent's delegated access to read data, execute actions and pivot into connected systems.

AML.T0108

Initial Access

Attacker obtains a low-privilege shared token or password and opens a WebSocket connection to the OpenClaw gateway.

AML.T0012

Privilege Escalation

Connect request self-declares operator.admin scope, which the server accepts without server-side binding.

AML.T0049

Admin Operations

Attacker performs admin-only gateway operations such as changing agent configuration, tools or sessions.

AML.T0053

Impact

Attacker abuses the agent's delegated access to read data, execute actions and pivot into connected systems.

AML.T0108

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~7d to patchFull package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade OpenClaw to 2026.3.12 or later (per vendor advisory GHSA-rqpp-rjj8-7wv8). 2) Rotate all shared tokens and passwords used for gateway WebSocket connections, assuming any holder could have escalated. 3) Restrict gateway network exposure: bind to localhost or private networks, place behind VPN or an authenticating reverse proxy, and avoid direct internet exposure. 4) Prefer per-user credentials with server-side scope assignment over shared secrets where supported. 5) Detection: audit gateway logs for WebSocket connects declaring operator.admin or other elevated scopes from identities that should not hold them, and for admin-only operations (config changes, tool or skill installs, session control) from unexpected sources. 6) Review agent tool permissions and connected credentials, applying least privilege so a compromised gateway has limited reach.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentAPIFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0108- AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-22172?

Is CVE-2026-22172 actively exploited?

No confirmed active exploitation of CVE-2026-22172 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22172?

1) Upgrade OpenClaw to 2026.3.12 or later (per vendor advisory GHSA-rqpp-rjj8-7wv8). 2) Rotate all shared tokens and passwords used for gateway WebSocket connections, assuming any holder could have escalated. 3) Restrict gateway network exposure: bind to localhost or private networks, place behind VPN or an authenticating reverse proxy, and avoid direct internet exposure. 4) Prefer per-user credentials with server-side scope assignment over shared secrets where supported. 5) Detection: audit gateway logs for WebSocket connects declaring operator.admin or other elevated scopes from identities that should not hold them, and for admin-only operations (config changes, tool or skill installs, session control) from unexpected sources. 6) Review agent tool permissions and connected credentials, applying least privilege so a compromised gateway has limited reach.

What systems are affected by CVE-2026-22172?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent gateways, multi-user agent platforms, tool-calling agent orchestration.

What is the CVSS score for CVE-2026-22172?

CVE-2026-22172 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.58%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent gatewaysmulti-user agent platformstool-calling agent orchestration

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0108AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.

Exploitation Scenario

An attacker obtains a low-privilege shared gateway token, for example from a leaked config file, a CI log, or a contractor with read-only access, and opens a WebSocket connection to the OpenClaw gateway. In the connect message they self-declare scopes including operator.admin, and the server accepts them without verifying against the credential's actual privileges. With admin rights, the attacker reconfigures the agent, installs a malicious skill or tool, reads session data and connected-service credentials, and directs the agent to act against the victim's mailboxes, repositories or hosts, using the agent's own authorized access to pivot beyond the gateway.

Weaknesses (CWE)

CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.