OpenClaw WebSocket Vulnerability Confirmed as Zero-Day by 360 Security Team

Panewslab

OpenClaw WebSocket Vulnerability Confirmed as Zero-Day by 360 Security Team

First seen 22 Mar 2026, 11:14 UTC • •63.9

Article Content

1 / 3

Browse articles

ThreatCluster •March 22, 2026 at 22:28 UTC

•OpenClaw's WebSocket vulnerability is a confirmed zero-day exploit.
•Attackers can bypass authentication and control the smart agent gateway.
•360 Security has reported the vulnerability to CNVD for risk mitigation.

On March 22, 2026, Peter, the founder of OpenClaw, confirmed that the OpenClaw Gateway WebSocket unauthenticated upgrade vulnerability was exclusively discovered by the 360 Security Cloud team. This vulnerability is classified as a zero-day, allowing attackers to bypass authentication via WebSocket, potentially gaining control of the smart agent gateway. The exploitation of this vulnerability could lead to resource exhaustion or a complete system crash. The 360 team has reported this high-risk vulnerability to the National Information Security Vulnerability Sharing Platform (CNVD) to mitigate the risk across the network. As of now, there are no specific CVEs assigned to this vulnerability, and no patches have been released yet. The full impact scope remains to be assessed as the situation develops.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 172d ago How this analysis works

Timeline

2026-03-22

OpenClaw founder confirms vulnerability discovered by 360 Security.

2026-03-22

360 Security reports vulnerability to CNVD.

More articles in this cluster (2)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

Qihoo 360

Affected Platform (1)

WebSocket

Relationships

Zero-day Exploit targets WebSocket
Zero-day Exploit related to Qihoo 360

Following this threat?

Track Qihoo 360 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by…