Back Techflowpost

OpenClaw Founder Confirms 360's Exclusive Discovery of the Vulnerability

Techflowpost • March 22, 2026

TechFlow News: On March 22, according to JINSHI Data, the Qihoo 360 Cloud Security Team received an official email from Peter, founder of OpenClaw. In his , Peter officially confirmed the OpenClaw Gateway WebSocket unauthenticated upgrade vulnerability, which was exclusively discovered by the Qihoo 360 team. Qihoo 360 has already reported this critical vulnerability to the China National Vulnerability Database (CNVD) to help cut off the risk source across the network as soon as possible. This confirmed WebSocket unauthenticated upgrade vulnerability is a zero-day (0Day) vulnerability; attackers can exploit it to silently bypass authentication via WebSocket and gain control over the agent gateway, potentially leading to resource exhaustion or complete system collapse.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenClaw WebSocket Vulnerability Confirmed as Zero-Day by 360 Security Team On March 22, 2026, Peter, the founder of OpenClaw, confirmed that the OpenClaw Gateway WebSocket unauthenticated upgrade vulnerability was exclusively discovered by the 360 Security Cloud team. This vulnerability is classified as a zero-day, allowing attackers to bypass authentication via WebSocket, potentially gaining control of the smart agent gateway. The exploitation of this vulnerability could lead to resource exhaustion or a complete system crash. The 360 team has reported this high-risk vulnerability to the National Information Security Vulnerability Sharing Platform (CNVD) to mitigate the risk across the network. As of now, there are no specific CVEs assigned to this vulnerability, and no patches have been released yet. The full impact scope remains to be assessed as the situation develops. 2 sources 64

Extracted Entities

OpenClaw Founder Confirms 360's Exclusive Discovery of the Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)

Platforms (1)