OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket… (CVE-2026-62220)

The vulnerability in OpenClaw versions before 2026.5.26 permits lower-trust callers or configured input paths to circumvent non-browser rate limiting controls on WebSocket authentication attempts. This flaw exists when the feature controlling these rate limits is enabled and reachable by lower-trust inputs, enabling attackers to consume gateway resources disproportionately. The issue is identified as CWE-307, relating to improper restriction of excessive authentication attempts. No patch or remediation details are provided in the available data.

Successful exploitation can lead to resource exhaustion on the gateway, reducing service availability. This could degrade the performance or availability of the affected OpenClaw service, potentially causing denial of service conditions. There is no indication of privilege escalation or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected WebSocket authentication feature from lower-trust callers or input paths, or disabling the feature if not required. Monitor for unusual authentication request patterns that might indicate exploitation attempts.