OpenClaw WebSocket Authentication Vulnerability: Loopback Password Brute-Force Risk
Summary
GHSA-jmmg-jqc7-5qf4: This issue is a browser-origin WebSocket auth chain on local loopback deployments using password auth. Affects openclaw versions < 2026.2.25. Fixed in 2026.2.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for local use, facilitating trusted-operator workflows through its web/gateway interface. It primarily utilizes WebSocket connections for real-time communication. However, certain configurations expose it to vulnerabilities, particularly in local loopback deployments where password authentication is employed.
Vulnerability Detail
The vulnerability arises from a browser-origin WebSocket authentication chain that lacks adequate security measures in local loopback deployments. Specifically, the issue is characterized by three main factors: insufficient origin checks for certain WebSocket client IDs, exemption of loopback authentication attempts from password failure throttling, and the availability of silent local pairing paths for non-Control-UI clients. An attacker can exploit this vulnerability by tricking a user into opening a malicious webpage, allowing them to guess the gateway password through brute-force or dictionary attacks. If successful, the attacker can establish an authenticated WebSocket session and invoke control-plane methods, posing a significant risk to the system's integrity.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.25
This is the first release that contains the fix.
npm install openclaw@2026.2.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling password authentication for local loopback deployments or implementing additional network security measures to restrict access to the gateway.
Conclusion
In summary, the OpenClaw package has a significant vulnerability related to WebSocket authentication in local loopback deployments. Users are strongly advised to update to the patched version to mitigate the risks associated with this issue. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability is a local loopback authentication issue that allows attackers to exploit weak passwords through brute-force attempts.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If exploited, an attacker can gain unauthorized access to control-plane methods, potentially compromising the system's functionality and security.
Yes, a patch is available in version 2026.2.25 of the OpenClaw package. It is recommended to update to this version.
The CVSS score of this vulnerability is 5.7, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
