CVE-2026-62220: OpenClaw WS auth rate-limit bypass

CISO Take

OpenClaw's WebSocket gateway enforces rate limits on authentication attempts, but a lower-trust caller or a specific configured input path can bypass that non-browser rate limiter and flood the auth handshake, consuming gateway resources and degrading availability. The bug requires no privileges and no user interaction, is network-reachable, and has low attack complexity, but the CVSS 3.1 vector caps at 5.3 (medium) because the impact is limited to availability with no confidentiality or integrity loss. There is no evidence of active exploitation, no CISA KEV listing, no EPSS score published, and no public exploit or Nuclei template exists yet, so urgency is driven by exposure rather than observed attacks. Teams running OpenClaw agent gateways facing lower-trust networks or multi-tenant input paths should upgrade to 2026.5.26 or later, and in the interim add an upstream rate limiter (reverse proxy or WAF) in front of the WebSocket auth endpoint plus alerting on abnormal auth-attempt volume.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium risk overall. The vulnerability is trivially reachable (network, no auth, no user interaction, low complexity), which pushes exploitability up, but the impact is bounded to availability degradation of the gateway rather than data exposure or code execution. Real-world risk depends heavily on deployment topology: OpenClaw instances that expose the WebSocket auth path to untrusted networks or multi-tenant callers (the 'lower-trust caller or configured input path' condition) face meaningful DoS exposure; instances that only accept WebSocket connections from trusted internal callers are largely insulated. Absence of KEV listing, EPSS data, and public exploit code suggests this has not yet attracted attacker attention, but the low complexity means a working PoC could appear quickly.

How does the attack unfold?

Reconnaissance

Attacker identifies a lower-trust entry point or configured input path that reaches the OpenClaw WebSocket authentication feature.

AML.T0006

Rate-limit bypass

Attacker sends a high volume of WebSocket authentication attempts through the unrestricted path, evading the non-browser rate limiter.

AML.T0029

Resource exhaustion

The flood of auth attempts consumes gateway compute and connection-handling resources beyond normal capacity.

AML.T0034

Availability impact

Legitimate agent sessions and tool invocations routed through the gateway are degraded or dropped for the duration of the attack.

Reconnaissance

Attacker identifies a lower-trust entry point or configured input path that reaches the OpenClaw WebSocket authentication feature.

AML.T0006

Rate-limit bypass

Attacker sends a high volume of WebSocket authentication attempts through the unrestricted path, evading the non-browser rate limiter.

AML.T0029

Resource exhaustion

The flood of auth attempts consumes gateway compute and connection-handling resources beyond normal capacity.

AML.T0034

Availability impact

Legitimate agent sessions and tool invocations routed through the gateway are degraded or dropped for the duration of the attack.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

What should I do?

1 step

Upgrade OpenClaw to 2026.5.26 or later, which restores effective rate limiting on non-browser WebSocket authentication attempts. Until patched, place a reverse proxy or WAF with independent connection/auth-attempt rate limiting in front of the WebSocket endpoint, and restrict network reachability of the affected feature to trusted callers where the 'configured input path' allowing lower-trust access is not required. For detection, monitor gateway logs and metrics for abnormal spikes in WebSocket authentication attempts or connection churn from a single source, and alert on gateway resource saturation (CPU/connection pool exhaustion) correlated with auth traffic.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Auth Bypass Agent AML.T0029 - Denial of AI Service AML.T0034 - Cost Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-62220?

OpenClaw's WebSocket gateway enforces rate limits on authentication attempts, but a lower-trust caller or a specific configured input path can bypass that non-browser rate limiter and flood the auth handshake, consuming gateway resources and degrading availability. The bug requires no privileges and no user interaction, is network-reachable, and has low attack complexity, but the CVSS 3.1 vector caps at 5.3 (medium) because the impact is limited to availability with no confidentiality or integrity loss. There is no evidence of active exploitation, no CISA KEV listing, no EPSS score published, and no public exploit or Nuclei template exists yet, so urgency is driven by exposure rather than observed attacks. Teams running OpenClaw agent gateways facing lower-trust networks or multi-tenant input paths should upgrade to 2026.5.26 or later, and in the interim add an upstream rate limiter (reverse proxy or WAF) in front of the WebSocket auth endpoint plus alerting on abnormal auth-attempt volume.

Is CVE-2026-62220 actively exploited?

No confirmed active exploitation of CVE-2026-62220 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62220?

Upgrade OpenClaw to 2026.5.26 or later, which restores effective rate limiting on non-browser WebSocket authentication attempts. Until patched, place a reverse proxy or WAF with independent connection/auth-attempt rate limiting in front of the WebSocket endpoint, and restrict network reachability of the affected feature to trusted callers where the 'configured input path' allowing lower-trust access is not required. For detection, monitor gateway logs and metrics for abnormal spikes in WebSocket authentication attempts or connection churn from a single source, and alert on gateway resource saturation (CPU/connection pool exhaustion) correlated with auth traffic.

What systems are affected by CVE-2026-62220?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent orchestration/gateway, real-time agent communication (WebSocket).

What is the CVSS score for CVE-2026-62220?

CVE-2026-62220 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagent orchestration/gatewayreal-time agent communication (WebSocket)

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034 Cost Harvesting

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

Exploitation Scenario

An attacker with only network access to an OpenClaw deployment — or a lower-privileged tenant/caller reachable via a configured input path — repeatedly opens WebSocket connections and submits authentication attempts in rapid succession. Because the non-browser rate limiter fails to constrain this specific caller class, the flood is not throttled, and the gateway's compute and connection-handling resources are consumed processing the bogus auth attempts. Legitimate agent-to-gateway traffic then experiences degraded performance or outright unavailability, disrupting any downstream agent workflows, tool invocations, or orchestration relying on that gateway during the attack window.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts Primary CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.