High severity7.5NVD Advisory· Published Mar 11, 2026· Updated Jun 17, 2026
CVE-2026-32062
CVE-2026-32062
Description
OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.22 | 2026.2.22 |
@openclaw/voice-callnpm | < 2026.2.22 | 2026.2.22 |
Affected products
6cpe:2.3:a:openclaw:openclaw\/voice-call:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw\/voice-call:*:*:*:*:*:node.js:*:*range: <2026.2.22
- (no CPE)range: 2026.2.21
- ghsa-coords2 versions
< 2026.2.22+ 1 more
- (no CPE)range: < 2026.2.22
- (no CPE)range: < 2026.2.22
Patches
Vulnerability mechanics
References
5- github.com/openclaw/openclaw/commit/1d8968c8a821ff1a05c294a1846b3bcb6f343794nvdPatchWEB
- github.com/advisories/GHSA-mfg5-7q5g-f37jghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-mfg5-7q5g-f37jnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-32062ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-unauthenticated-websocket-resource-exhaustion-via-media-streamnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.