OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades

CAO 7.5CVE-2026-41399 · GHSA-f44p-c7w9-7xr7 · Công bố 28/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-41399 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.32%, cao hơn 24.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.28 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.28`	`2026.3.28`
openclaw npm	`< 2026.3.28`	`2026.3.28`

Mô tả

Summary

The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.

Impact

An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.

Affected Component

src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit cb5f7e201f (gateway: cap concurrent pre-auth websocket upgrades).

Discovered by：Topsec AlphaLab (wang dong)

Mô tả của NVD

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for legitimate clients.