CVE-2026-32062: Openclaw

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream WebSocket upgrades before stream validation, allowing unauthenticated clients to establish connections. Remote attackers can hold idle pre-authenticated sockets open to consume connection resources and degrade service availability for legitimate streams.

Affected products

• Openclaw Openclaw: before 2026.2.22 (fixed in 2026.2.22)
• Openclaw Openclaw/voice-Call: before 2026.2.22 (fixed in 2026.2.22)

Published 2026-03-11. Last modified 2026-06-17.