CVE-2026-32025: OpenClaw WebSocket auth bypass

CISO Take

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap that allows an attacker to trick a user into visiting a malicious webpage, which then bypasses WebSocket origin checks and auth throttling to brute-force the loopback gateway and establish an authenticated operator session. The EPSS score places this in the top 79th percentile for exploitation likelihood—unusually high for a vulnerability not yet in CISA KEV—meaning real-world attackers are statistically more likely than average to target this flaw before a public exploit is published. Once an operator session is obtained, the adversary can invoke control-plane methods on the AI agent, potentially redirecting agent behavior, accessing connected tools and data stores, or pivoting further into the environment. With 396 other CVEs in this same package and 4 downstream dependents, organizations running OpenClaw locally carry compounding risk across their AI agent deployments. Patch immediately to version 2026.2.25+ (commit c736f11a); as an interim control, restrict loopback WebSocket access at the OS firewall layer and monitor gateway authentication logs for brute-force patterns.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

HIGH severity (CVSS 7.5) with network attack vector, but elevated complexity (AC:H) and mandatory user interaction (UI:R) limit opportunistic exploitation. The EPSS 79th percentile is notable given no public exploit exists—suggesting elevated threat actor interest even before weaponization. The primary risk amplifier is the target: an AI agent control plane with operator-level privileges. A compromised operator session in an agentic framework is functionally equivalent to privileged code execution in traditional systems. Loopback-only deployment scope nominally limits lateral movement, but browser-mediated attacks make 'loopback' a weaker boundary than it appears—any user browsing from the same machine running OpenClaw is a viable target, including developers on CI/CD workstations and security researchers.

How does the attack unfold?

Initial Access

Attacker lures the victim into opening a malicious webpage via phishing or social engineering; no visible indication of background activity occurs.

AML.T0011.003

Origin Check Bypass

Malicious JavaScript silently initiates WebSocket connections to the victim's loopback OpenClaw gateway, circumventing origin validation that should block cross-origin browser requests.

AML.T0078

Credential Brute-Force

Auth throttling is absent or bypassable (CWE-307), enabling automated high-speed password guessing against the gateway credentials without account lockout or rate limiting.

AML.T0106

Agent Control-Plane Takeover

With an authenticated operator session established, the attacker invokes control-plane methods through the victim's browser to manipulate AI agent behavior, access agent tools, or exfiltrate configuration and connected data.

AML.T0053

Initial Access

Attacker lures the victim into opening a malicious webpage via phishing or social engineering; no visible indication of background activity occurs.

AML.T0011.003

Origin Check Bypass

Malicious JavaScript silently initiates WebSocket connections to the victim's loopback OpenClaw gateway, circumventing origin validation that should block cross-origin browser requests.

AML.T0078

Credential Brute-Force

Auth throttling is absent or bypassable (CWE-307), enabling automated high-speed password guessing against the gateway credentials without account lockout or rate limiting.

AML.T0106

Agent Control-Plane Takeover

With an authenticated operator session established, the attacker invokes control-plane methods through the victim's browser to manipulate AI agent behavior, access agent tools, or exfiltrate configuration and connected data.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

6 steps

Immediate: Upgrade to OpenClaw ≥ 2026.2.25 (patch commit: c736f11a16d6bc27ea62a0fe40fffae4cb071fdb).
If upgrade is not immediately possible, restrict WebSocket connections to the loopback gateway using OS-level firewall rules—block inbound WebSocket requests originating from browser processes where feasible.
Enforce strong, randomly generated gateway passwords to raise the bar for brute-force success even if throttling is absent.
Monitor authentication logs on the OpenClaw gateway for abnormal failed authentication sequences (e.g., >5 attempts within 60 seconds from localhost).
Review which control-plane methods are exposed and disable non-essential ones as a defense-in-depth measure.
Alert on unexpected operator sessions established outside of normal maintenance windows.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0011.003 - Malicious Link AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0078 - Drive-by Compromise AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.9.4.2 - Secure log-on procedures

NIST AI RMF

MANAGE 2.4 - Mechanisms are in place for AI risks to be managed

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32025?

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap that allows an attacker to trick a user into visiting a malicious webpage, which then bypasses WebSocket origin checks and auth throttling to brute-force the loopback gateway and establish an authenticated operator session. The EPSS score places this in the top 79th percentile for exploitation likelihood—unusually high for a vulnerability not yet in CISA KEV—meaning real-world attackers are statistically more likely than average to target this flaw before a public exploit is published. Once an operator session is obtained, the adversary can invoke control-plane methods on the AI agent, potentially redirecting agent behavior, accessing connected tools and data stores, or pivoting further into the environment. With 396 other CVEs in this same package and 4 downstream dependents, organizations running OpenClaw locally carry compounding risk across their AI agent deployments. Patch immediately to version 2026.2.25+ (commit c736f11a); as an interim control, restrict loopback WebSocket access at the OS firewall layer and monitor gateway authentication logs for brute-force patterns.

Is CVE-2026-32025 actively exploited?

No confirmed active exploitation of CVE-2026-32025 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32025?

1. Immediate: Upgrade to OpenClaw ≥ 2026.2.25 (patch commit: c736f11a16d6bc27ea62a0fe40fffae4cb071fdb). 2. If upgrade is not immediately possible, restrict WebSocket connections to the loopback gateway using OS-level firewall rules—block inbound WebSocket requests originating from browser processes where feasible. 3. Enforce strong, randomly generated gateway passwords to raise the bar for brute-force success even if throttling is absent. 4. Monitor authentication logs on the OpenClaw gateway for abnormal failed authentication sequences (e.g., >5 attempts within 60 seconds from localhost). 5. Review which control-plane methods are exposed and disable non-essential ones as a defense-in-depth measure. 6. Alert on unexpected operator sessions established outside of normal maintenance windows.

What systems are affected by CVE-2026-32025?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, AI agent gateways, developer workstation AI tools.

What is the CVSS score for CVE-2026-32025?

CVE-2026-32025 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsAI agent gatewaysdeveloper workstation AI tools

MITRE ATLAS Techniques

AML.T0011.003 Malicious Link

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0078 Drive-by Compromise

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.9.4.2

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-force attacks against the gateway to establish an authenticated operator session and invoke control-plane methods.

Exploitation Scenario

An attacker crafts a webpage containing JavaScript that silently initiates WebSocket connections to ws://localhost:<openclaw-port>/gateway from the victim's browser. Due to missing origin validation, the browser's cross-origin restrictions do not block the request. The script systematically brute-forces common or default gateway passwords without triggering auth throttling (CWE-307), cycling through credentials at high speed. Once authenticated, the attacker's code invokes control-plane methods through the victim's browser context: exfiltrating agent configuration, injecting malicious instructions into the agent's operation queue, or leveraging the agent's tool access—file system reads, external API calls, or code execution—to pivot laterally into connected systems. The victim sees nothing unusual; the attack completes silently within seconds of loading the malicious page.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.