CVE-2026-100558: OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth connection budget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote client that can reach the OpenClaw Gateway listener can attempt exploitation. No credentials or user interaction are required.
Does the WebSocket pre-auth connection limit protect against this attack?
No. The issue allows response sockets to be retained without consuming the WebSocket pre-auth connection budget, so that budget does not prevent resource exhaustion through malformed upgrade requests.
What is the practical impact of successful exploitation?
An attacker can repeatedly send malformed WebSocket upgrade requests to exhaust Gateway listener resources and cause denial of service.
Which versions need remediation?
OpenClaw versions before 2026.8.1 are affected. Upgrading to 2026.8.1 or later addresses the affected version range.