{"id":"EUVD-2026-13704","enisaUuid":"20b5b8c1-33e3-323b-a0a7-eeb116c61b67","description":"OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.","datePublished":"Mar 20, 2026, 2:48:28 PM","dateUpdated":"Sep 24, 2026, 2:17:19 PM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rqpp-rjj8-7wv8\nhttps://www.vulncheck.com/advisories/openclaw-scope-elevation-in-websocket-shared-auth-connections\n","aliases":"CVE-2026-22172\n","assigner":"VulnCheck","epss":0.58,"enisaIdProduct":[{"id":"c405121a-4bdc-3058-ba99-5065837aec5d","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.3.12"}],"enisaIdVendor":[{"id":"4676a6d0-eb5d-306a-b5db-3cf903ee383d","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"0752413e-7176-3079-975f-0bffa4575ed7","vulnerability":{"id":"GHSA-rqpp-rjj8-7wv8","description":"OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes","datePublished":"Mar 13, 2026, 8:55:24 PM","dateUpdated":"Mar 20, 2026, 9:04:19 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rqpp-rjj8-7wv8\nhttps://github.com/openclaw/openclaw/pull/44306\nhttps://github.com/openclaw/openclaw/commit/5e389d5e7c9233ec91026ab2fea299ebaf3249f6\nhttps://github.com/openclaw/openclaw\nhttps://github.com/openclaw/openclaw/releases/tag/v2026.3.12\n","enisa_id":"EUVD-2026-13704\n","aliases":"CVE-2026-22172\nGHSA-rqpp-rjj8-7wv8\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:46:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"98939825-0ec3-322b-90a3-af8626e070f3","vulnerability":{"id":"CVE-2026-22172","description":"OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.","datePublished":"Mar 20, 2026, 2:48:28 PM","dateUpdated":"Sep 24, 2026, 2:17:19 PM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rqpp-rjj8-7wv8\nhttps://www.vulncheck.com/advisories/openclaw-scope-elevation-in-websocket-shared-auth-connections\n","enisa_id":"EUVD-2026-13704\n","assigner":"VulnCheck","epss":0.58,"dataProcessed":"Nov 11, 2026, 7:24:57 AM","vulnerabilityProduct":[{"id":"795408d6-e224-3a3d-aafb-3a87a2d6a168","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.3.12"}],"vulnerabilityVendor":[{"id":"69c3a777-88f7-3344-85b4-c84c225e35b5","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[{"id":"8d7b0409-8898-3f2b-8478-a99facf9d505","advisory":{"id":"WID-SEC-W-2026-0727","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen – sogar Administratorrechte – zu erlangen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.","datePublished":"Mar 15, 2026, 11:00:00 PM","dateUpdated":"Mar 31, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0727.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0727\n","aliases":"CVE-2026-22172\nCVE-2026-32914\nCVE-2026-32915\nCVE-2026-32917\nCVE-2026-32971\nCVE-2026-32972\nCVE-2026-32974\nCVE-2026-32980\nCVE-2026-32988\nCVE-2026-33572\nCVE-2026-33573\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"22544d18-aaef-3088-a024-a220ee11abae","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}},{"id":"a50b4b25-3d37-3379-91b6-5bae3087927d","product":{"name":"2026.3.13","vendor":{"name":"open source"}}}]}}]}