OpenClaw WebSocket Vulnerability Confirmed as Zero-Day by 360 Security Team

Panewslab

OpenClaw WebSocket Vulnerability Confirmed as Zero-Day by 360 Security Team

First seen 22 Mar 2026, 11:14 UTC • •63.9

Article Content

1 / 3

Browse articles

ThreatCluster •March 22, 2026 at 22:28 UTC

•OpenClaw's WebSocket vulnerability is a confirmed zero-day exploit.
•Attackers can bypass authentication and control the smart agent gateway.
•360 Security has reported the vulnerability to CNVD for risk mitigation.

On March 22, 2026, Peter, the founder of OpenClaw, confirmed that the OpenClaw Gateway WebSocket unauthenticated upgrade vulnerability was exclusively discovered by the 360 Security Cloud team. This vulnerability is classified as a zero-day, allowing attackers to bypass authentication via WebSocket, potentially gaining control of the smart agent gateway. The exploitation of this vulnerability could lead to resource exhaustion or a complete system crash. The 360 team has reported this high-risk vulnerability to the National Information Security Vulnerability Sharing Platform (CNVD) to mitigate the risk across the network. As of now, there are no specific CVEs assigned to this vulnerability, and no patches have been released yet. The full impact scope remains to be assessed as the situation develops.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

Timeline

2026-03-22

OpenClaw founder confirms vulnerability discovered by 360 Security.

2026-03-22

360 Security reports vulnerability to CNVD.

More articles in this cluster (2)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Organization (1)

Qihoo 360

Affected Platform (1)

WebSocket

Relationships

Zero-day Exploit targets WebSocket
Zero-day Exploit related to Qihoo 360

Following this threat?

Track Qihoo 360 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…