CVE-2026-26322: WebSocket Outbound Connection in OpenClaw

The primary impact of CVE-2026-26322 is the potential for unauthorized outbound network connections. An attacker who can influence the gatewayUrl parameter can redirect OpenClaw's WebSocket connections to malicious servers, potentially exfiltrating sensitive data or establishing a command-and-control channel. This could lead to data breaches, system compromise, and further malicious activity. The ability to control outbound connections bypasses typical network segmentation and security controls, significantly expanding the attack surface.

1. Reserved2026-02-13
2. Published2026-02-17
3. Modified2026-02-20
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-26322 is to upgrade to OpenClaw version 2026.2.14 or later, which addresses the insufficient input validation. If upgrading is not immediately feasible, consider implementing strict network egress filtering rules to block outbound WebSocket connections to untrusted destinations. Monitor network traffic for unusual WebSocket connections originating from OpenClaw processes. Review and restrict access to tools that accept and process the gatewayUrl parameter, limiting it to trusted operators and automation.