Shen Chao TechFlow News: On March 22, according to Jin Shi Data, the 360 Security Cloud team received an official email from OpenClaw founder Peter. In his reply, Peter officially confirmed the existence of an unauthenticated WebSocket upgrade vulnerability in the OpenClaw Gateway, which was exclusively discovered by the 360 team. Currently, 360 has reported this high-risk vulnerability to the National Information Security Vulnerability Sharing Platform (CNVD) to assist in promptly cutting off the source of the risk across the entire network. This confirmed WebSocket unauthenticated upgrade vulnerability is a zero-day (0Day) vulnerability. Attackers can exploit this flaw to silently bypass authentication via WebSocket, gain control of the agent gateway, and potentially lead to resource exhaustion or total system collapse.

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin