CVE-2026-32062

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-320637.8OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-co CVE-2026-320649.1OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing CVE-2026-320656.5OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as CVE-2026-320678.1OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pa CVE-2026-320687.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized att CVE-2026-320697.8Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.CVE-2026-32079.8Configuration issue in Java Management Extensions (JMX) in TIBCO BPM Enterprise version 4.x allows unauthorised access.CVE-2026-320707.0Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.CVE-2026-320717.5Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over CVE-2026-320726.2Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.CVE-2026-320737.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-320747.8Double free in Windows Projected File System allows an authorized attacker to elevate privileges locally.