Improper Output Neutralization for Logs in OpenClaw - #VU129442
Published: May 4, 2026
Vulnerability identifier: #VU129442
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-117
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to poison logs and influence downstream LLM-assisted workflows.
The vulnerability exists due to improper output neutralization for logs in src/gateway/server/ws-connection.ts when handling WebSocket connections that close before completing the connect or handshake process. A remote attacker can send crafted WebSocket header values to poison logs and influence downstream LLM-assisted workflows.
The impact depends on logs later being read or interpreted by an LLM or other automation, and user interaction is required.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.2.13