360 Exclusively Discovers OpenClaw Gateway Zero-Day Vulnerability, Founder Confirms Officially

360 Security Cloud Team recently received an official email from Peter, founder of OpenClaw, who formally confirmed the unauthenticated WebSocket upgrade vulnerability in OpenClaw Gateway exclusively discovered by the team.

This confirmed vulnerability is a zero-day (0Day) vulnerability. Attackers can silently bypass permission authentication via WebSocket to gain control of the agent gateway, which may lead to resource exhaustion or total collapse of the target system. Currently, 360 has reported this high-risk vulnerability to the National Vulnerability Database of China (CNVD) to help cut off the risk source across the network as soon as possible.