CVE-2026-62210: OpenClaw slow-read DoS

CISO Take

OpenClaw's AI agent gateway is vulnerable to a slow-read denial-of-service attack: when the gateway fetches remote media URLs supplied through configured input paths, it holds worker resources open for the duration of the read, and a slow or throttled remote server can starve that worker indefinitely. This CVSS 6.5 flaw only requires low privileges (access to an input path) and no user interaction, so a semi-trusted user with one exposed integration point can degrade or take down the gateway for everyone behind it — no data is exposed or altered, but availability is the blast radius. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't being mass-exploited today, but the underlying pattern (CWE-770, unbounded resource allocation) is trivial to reproduce with off-the-shelf slow-read tooling once an input path is reachable. Patch to OpenClaw 2026.6.1 or later, and in the meantime enforce read/connect timeouts and concurrency caps on remote media fetches, restrict which accounts can submit input-path URLs, and alert on gateway worker pool exhaustion or unusually long-lived outbound fetch connections.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

Medium severity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) — pure availability impact with no confidentiality or integrity loss. Exploitation requires low privileges (access to a configured input path) but no user interaction and low attack complexity, so any actor who can reach an input-taking endpoint can attempt the attack. No EPSS score, CISA KEV listing, public exploit, or Nuclei template exists, indicating no known active exploitation, but the technique (slow-read/slow-drip resource exhaustion) is well understood and cheap to execute once discovered. Risk is bounded by the PR:L requirement — this is not a fully unauthenticated, internet-wide DoS — but any deployment exposing input paths to lower-trust users (e.g., multi-tenant agent gateways, public-facing chat interfaces) should treat this as exploitable today.

How does the attack unfold?

Initial Access

Attacker with access to a configured input path submits a remote media URL pointing to a server they control.

AML.T0049

Resource-Intensive Request

The attacker's server responds at an artificially slow rate, causing the gateway worker to block while waiting for the transfer to complete.

AML.T0034.001

Worker Pool Exhaustion

The attacker repeats the technique across multiple requests, tying up an increasing share of the gateway's available workers.

AML.T0029

Impact

Legitimate requests to the gateway queue, time out, or fail, resulting in denial of service for agents and users sharing that gateway.

AML.T0029

Initial Access

Attacker with access to a configured input path submits a remote media URL pointing to a server they control.

AML.T0049

Resource-Intensive Request

The attacker's server responds at an artificially slow rate, causing the gateway worker to block while waiting for the transfer to complete.

AML.T0034.001

Worker Pool Exhaustion

The attacker repeats the technique across multiple requests, tying up an increasing share of the gateway's available workers.

AML.T0029

Impact

Legitimate requests to the gateway queue, time out, or fail, resulting in denial of service for agents and users sharing that gateway.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Patch OpenClaw to version 2026.6.1 or later, which fixes the slow-read handling per the GitHub Security Advisory (GHSA-4xwj-mcc7-x7x5). Until patched, enforce strict connect/read timeouts and maximum transfer duration on any outbound fetch of remote media, cap concurrent fetches per worker, and restrict which principals can submit URLs via configured input paths. Detect exploitation attempts by monitoring for abnormally long-lived outbound connections from gateway workers, worker pool saturation or queue depth spikes, and repeated slow-responding remote hosts referenced by the same source; alert if gateway latency/error rate degrades in correlation with a spike in remote-media fetch requests.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent Plugin AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.6 - AI system is evaluated for safety, security, and resilience

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-62210?

OpenClaw's AI agent gateway is vulnerable to a slow-read denial-of-service attack: when the gateway fetches remote media URLs supplied through configured input paths, it holds worker resources open for the duration of the read, and a slow or throttled remote server can starve that worker indefinitely. This CVSS 6.5 flaw only requires low privileges (access to an input path) and no user interaction, so a semi-trusted user with one exposed integration point can degrade or take down the gateway for everyone behind it — no data is exposed or altered, but availability is the blast radius. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this isn't being mass-exploited today, but the underlying pattern (CWE-770, unbounded resource allocation) is trivial to reproduce with off-the-shelf slow-read tooling once an input path is reachable. Patch to OpenClaw 2026.6.1 or later, and in the meantime enforce read/connect timeouts and concurrency caps on remote media fetches, restrict which accounts can submit input-path URLs, and alert on gateway worker pool exhaustion or unusually long-lived outbound fetch connections.

Is CVE-2026-62210 actively exploited?

No confirmed active exploitation of CVE-2026-62210 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62210?

Patch OpenClaw to version 2026.6.1 or later, which fixes the slow-read handling per the GitHub Security Advisory (GHSA-4xwj-mcc7-x7x5). Until patched, enforce strict connect/read timeouts and maximum transfer duration on any outbound fetch of remote media, cap concurrent fetches per worker, and restrict which principals can submit URLs via configured input paths. Detect exploitation attempts by monitoring for abnormally long-lived outbound connections from gateway workers, worker pool saturation or queue depth spikes, and repeated slow-responding remote hosts referenced by the same source; alert if gateway latency/error rate degrades in correlation with a spike in remote-media fetch requests.

What systems are affected by CVE-2026-62210?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI gateways/orchestration, multimodal input pipelines.

What is the CVSS score for CVE-2026-62210?

CVE-2026-62210 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI gateways/orchestrationmultimodal input pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.6

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce availability.

Exploitation Scenario

An attacker with access to a configured input path — for example, a chat or automation integration that lets users attach a 'media URL' for the agent to process — points that field at a server under their control configured to send response bytes at an extremely slow rate (a classic slow-read/slowloris-style drip). The OpenClaw gateway worker assigned to fetch that URL blocks waiting for the transfer to complete, tying up the worker far longer than a normal request would. By submitting several such URLs in parallel, the attacker exhausts the gateway's available worker pool, causing legitimate requests from other users or agents sharing that gateway to queue, time out, or be rejected, producing a denial of service without touching any data.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.