OpenClaw Founder Responds Confirming 360 Exclusively Discovered Vulnerability

CycleProphet · 2026-03-22T09:11:40+00:00

The 360 Security Cloud team confirmed an unauthenticated WebSocket upgrade vulnerability in OpenClaw Gateway. This vulnerability is a zero-day, which attackers can exploit to bypass permission authentication, control the agent gateway, and potentially cause system crashes. 360 has reported the vulnerability to the National Information Security Vulnerability Sharing Platform.

CycleProphet

2026-03-22 09:11:40

Abstract generation in progress

Deep Tide TechFlow News, March 22 — According to Jinshi Data, the 360 Security Cloud Team received an official email from OpenClaw founder Peter. In his reply, Peter officially confirmed the exclusive discovery by the 360 team of an unauthenticated upgrade vulnerability in OpenClaw Gateway WebSocket. Currently, 360 has reported this high-risk vulnerability to the National Vulnerability Database (CNVD) to help the entire network quickly cut off the source of risk. This confirmed WebSocket unauthenticated upgrade vulnerability is a zero-day (0Day) vulnerability. Attackers can exploit this flaw to silently bypass permission authentication via WebSocket, gaining control of the agent gateway, which could lead to resource exhaustion or total system crash.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes