CVE-2026-22172 — OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the…

Key facts

CVE-2026-22172 is a Critical (9.9) vulnerability: OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-22172
Severity	Critical (9.9)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-22172/

Details

CVE-2026-22172 is a Critical (9.9) vulnerability: OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description

OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-22172
CVSS Score	9.9

Proof of Concept

Download

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-22172/poc.py

Usage

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start

# Clone and navigate to CVE directory
cd CVE-2026-22172

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rqpp-rjj8-7wv8
• https://www.vulncheck.com/advisories/openclaw-scope-elevation-in-websocket-shared-auth-connections

---

Generated by PoC Generator on 2026-04-10T15:38:05.318137788

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-22172, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-22172 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-22172 OpenClaw WebSocket Authorization Bypass Attempt"; flow:established,to_server; content:"Upgrade|3a 20|websocket"; nocase; content:"operator.admin"; distance:0; classtype:policy-violation; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-22172 OpenClaw Self-Declared Elevated Scope"; flow:established,to_server; content:"ws://"; nocase; content:"scope"; distance:0; content:"operator."; distance:0; classtype:policy-violation; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-22172 OpenClaw WebSocket Scope Elevation"; flow:established,to_server; content:"Connection|3a 20|Upgrade"; nocase; content:"scope|22 3a|"; distance:0; content:"admin"; distance:0; classtype:policy-violation; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-22172 OpenClaw Unauthorized Gateway Operation"; flow:established,to_server; content:"Sec-WebSocket-Protocol"; nocase; content:"scope"; distance:0; pcre:"/operator\.(admin|root|super)/i"; classtype:policy-violation; sid:1000003; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-22172 OpenClaw Token-based Scope Bypass"; flow:established,to_server; content:"|7b|"; content:"token"; distance:0; content:"scope"; distance:0; content:"operator"; distance:0; classtype:policy-violation; sid:1000004; rev:1; priority:2;)

:material-file-download: prevention/snort.rules

rule CVE_2026_22172_OpenClaw_AuthZ_Bypass {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw authorization bypass vulnerability exploitation attempts"
        cve = "CVE-2026-22172"
        severity = "high"
        date = "2024-01-01"

    strings:
        $websocket_connect1 = "WebSocket" nocase
        $websocket_connect2 = "ws://" nocase
        $websocket_connect3 = "wss://" nocase

        $scope_admin1 = "operator.admin"
        $scope_admin2 = "admin"
        $scope_admin3 = "elevated"
        $scope_admin4 = "privilege"

        $auth_token1 = "shared-token"
        $auth_token2 = "password-authenticated"
        $auth_token3 = "self-declare"

        $openclaw_ref1 = "OpenClaw" nocase
        $openclaw_ref2 = "openclaw" nocase

        $gateway_ops1 = "gateway"
        $gateway_ops2 = "admin-only"

        $hex_ws_upgrade = { 47 45 54 20 2F [0-50] 48 54 54 50 2F 31 2E 31 0D 0A [0-100] 55 70 67 72 61 64 65 3A 20 77 65 62 73 6F 63 6B 65 74 }

        $bypass_pattern = /scope[s]?\s*[:=]\s*["\']?(operator\.admin|admin|elevated)["\']?/

    condition:
        (any of ($websocket_connect*) and any of ($scope_admin*)) or
        (any of ($auth_token*) and any of ($scope_admin*)) or
        (any of ($openclaw_ref*) and any of ($gateway_ops*) and any of ($scope_admin*)) or
        $hex_ws_upgrade or
        $bypass_pattern
}

rule CVE_2026_22172_OpenClaw_Exploit_Memory {
    meta:
        author = "Security Engineer"
        description = "Detects in-memory artifacts of OpenClaw authorization bypass exploitation"
        cve = "CVE-2026-22172"
        severity = "high"
        date = "2024-01-01"

    strings:
        $memory_pattern1 = { 6F 70 65 72 61 74 6F 72 2E 61 64 6D 69 6E }  // "operator.admin"
        $memory_pattern2 = { 73 68 61 72 65 64 2D 74 6F 6B 65 6E }        // "shared-token"
        $memory_pattern3 = { 73 65 6C 66 2D 64 65 63 6C 61 72 65 }        // "self-declare"

        $ws_header = { 0D 0A 55 70 67 72 61 64 65 3A 20 77 65 62 73 6F 63 6B 65 74 0D 0A }

        $json_scope = /"scope[s]?"\s*:\s*"(operator\.admin|admin|elevated)"/

    condition:
        2 of ($memory_pattern*) or
        ($ws_header and any of ($memory_pattern*)) or
        $json_scope
}

rule CVE_2026_22172_OpenClaw_Config_Tampering {
    meta:
        author = "Security Engineer"
        description = "Detects configuration files modified for OpenClaw authorization bypass"
        cve = "CVE-2026-22172"
        severity = "medium"
        date = "2024-01-01"

    strings:
        $config_scope1 = "scope" nocase
        $config_scope2 = "scopes" nocase

        $admin_elevation = "operator.admin"
        $bypass_marker1 = "self-declare"
        $bypass_marker2 = "unauthorized"

        $version_vulnerable = /OpenClaw\s+[0-9]+\.[0-9]+\.[0-9]+/ nocase

        $websocket_config = "WebSocket" nocase
        $auth_config = /(shared-token|password-authenticated)/

    condition:
        (any of ($config_scope*) and $admin_elevation) or
        (any of ($bypass_marker*) and $websocket_config) or
        ($version_vulnerable and $auth_config and $admin_elevation)
}

:material-file-download: prevention/yara.yar

# CVE-2026-22172 - OpenClaw WebSocket Authorization Bypass Prevention

# Block WebSocket upgrade requests with suspicious scope declarations
location ~* ^/websocket|^/ws|^/socket\.io {
    # Block requests containing elevated scope claims in headers
    if ($http_authorization ~* "(operator\.admin|admin|root|superuser)") {
        return 403;
    }

    # Block requests with scope parameters in query string
    if ($args ~* "(scope|scopes)=.*(operator\.admin|admin|root|superuser)") {
        return 403;
    }

    # Block WebSocket handshake with suspicious scope claims in any header
    if ($http_x_scope ~* "(operator\.admin|admin|root|superuser)") {
        return 403;
    }

    if ($http_x_auth_scope ~* "(operator\.admin|admin|root|superuser)") {
        return 403;
    }

    # Block JSON payloads in WebSocket upgrade containing scope escalation
    if ($request_body ~* "\"scope[s]?\":\s*\"[^\"]*(?:operator\.admin|admin|root|superuser)") {
        return 403;
    }

    # Validate WebSocket upgrade requests
    if ($http_upgrade !~* "websocket") {
        return 400;
    }

    if ($http_connection !~* "upgrade") {
        return 400;
    }

    # Add security headers
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Rate limiting for WebSocket connections
    limit_req zone=ws_limit burst=10 nodelay;

    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# Block direct access to OpenClaw admin endpoints
location ~* ^/(admin|operator|management) {
    # Require proper authentication headers
    if ($http_authorization = "") {
        return 401;
    }

    # Block shared token authentication for admin paths
    if ($http_authorization ~* "Bearer\s+shared-") {
        return 403;
    }

    # Block suspicious scope claims in admin requests
    if ($request_body ~* "\"scope[s]?\":\s*\"[^\"]*(?:operator\.admin|admin\.elevated)") {
        return 403;
    }

    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;

    proxy_pass http://backend;
}

# Rate limiting zone for WebSocket connections
http {
    limit_req_zone $binary_remote_addr zone=ws_limit:10m rate=5r/s;
}

# Block requests with malformed or suspicious token formats
location / {
    # Block tokens that appear to be shared tokens used inappropriately
    if ($http_authorization ~* "Bearer\s+shared-[a-zA-Z0-9]+-admin") {
        return 403;
    }

    # Block requests attempting to inject scope claims via custom headers
    if ($http_x_requested_scope ~* "(operator\.admin|admin|root)") {
        return 403;
    }

    # Block POST/PUT requests with scope escalation attempts
    if ($request_method ~ ^(POST|PUT)$) {
        if ($request_body ~* "\"privileges?\":\s*\[?[^]]*\"admin") {
            return 403;
        }
    }
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-22172 - OpenClaw Authorization Bypass
# Protects against WebSocket authorization bypass allowing scope elevation

# Rule 1000000: Block WebSocket upgrade requests with suspicious scope declarations
SecRule REQUEST_HEADERS:Upgrade "@streq websocket" \
    "id:1000000,\
    phase:1,\
    block,\
    msg:'CVE-2026-22172: Potential OpenClaw WebSocket authorization bypass attempt',\
    logdata:'WebSocket upgrade with suspicious scope: %{MATCHED_VAR}',\
    severity:CRITICAL,\
    tag:'attack-authorization',\
    tag:'cve-2026-22172',\
    chain"
    SecRule REQUEST_HEADERS:Connection "@contains upgrade" \
        "chain"
        SecRule ARGS|REQUEST_BODY "@rx (?i)(operator\.admin|admin\.scope|elevated\.scope)" \
            "t:urlDecodeUni,t:lowercase"

# Rule 1000001: Block requests attempting to self-declare admin scopes in WebSocket handshake
SecRule REQUEST_HEADERS:Sec-WebSocket-Protocol "@rx (?i)(operator\.admin|admin\.scope|scope\.admin)" \
    "id:1000001,\
    phase:1,\
    block,\
    msg:'CVE-2026-22172: OpenClaw WebSocket admin scope self-declaration blocked',\
    logdata:'Suspicious WebSocket protocol: %{MATCHED_VAR}',\
    severity:CRITICAL,\
    tag:'attack-authorization',\
    tag:'cve-2026-22172'"

# Rule 1000002: Monitor WebSocket requests with shared-token authentication attempting scope elevation
SecRule REQUEST_URI "@contains /websocket" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-22172: OpenClaw WebSocket scope elevation attempt detected',\
    logdata:'WebSocket request with scope elevation: %{REQUEST_URI}',\
    severity:HIGH,\
    tag:'attack-authorization',\
    tag:'cve-2026-22172',\
    chain"
    SecRule ARGS|REQUEST_BODY "@rx (?i)(shared.?token|password.?auth).*(operator\.admin|admin\.scope|scope\.elevation)" \
        "t:urlDecodeUni,t:lowercase"

# Rule 1000003: Block JSON payloads in WebSocket paths containing unauthorized scope declarations
SecRule REQUEST_URI "@rx /(?:websocket|ws|socket)" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-22172: OpenClaw unauthorized scope declaration in WebSocket JSON',\
    logdata:'Unauthorized scope in payload: %{MATCHED_VAR}',\
    severity:HIGH,\
    tag:'attack-authorization',\
    tag:'cve-2026-22172',\
    chain"
    SecRule REQUEST_BODY "@rx (?i)\"scope\":\s*\[\s*\"(?:operator\.admin|admin\.scope|gateway\.admin)\"" \
        "t:urlDecodeUni"

# Rule 1000004: Block requests with OpenClaw-specific headers attempting authorization bypass
SecRule REQUEST_HEADERS:/^X-OpenClaw-/ "@rx (?i)(scope|auth|token)" \
    "id:1000004,\
    phase:1,\
    block,\
    msg:'CVE-2026-22172: OpenClaw authorization bypass via custom headers',\
    logdata:'Suspicious OpenClaw header: %{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
    severity:HIGH,\
    tag:'attack-authorization',\
    tag:'cve-2026-22172',\
    chain"
    SecRule MATCHED_VAR "@rx (?i)(operator\.admin|admin\.scope|elevated)" \
        "t:urlDecodeUni,t:lowercase"

# Rule 1000005: Monitor and block gateway operation requests without proper authorization
SecRule REQUEST_URI "@rx /(?:gateway|admin|operator)" \
    "id:1000005,\
    phase:2,\
    block,\
    msg:'CVE-2026-22172: OpenClaw unauthorized gateway operation attempt',\
    logdata:'Gateway operation without proper auth: %{REQUEST_URI}',\
    severity:CRITICAL,\
    tag:'attack-authorization',\
    tag:'cve-2026-22172',\
    chain"
    SecRule REQUEST_HEADERS:Authorization "@rx (?i)(shared.?token|basic)" \
        "chain"
        SecRule ARGS|REQUEST_BODY "@rx (?i)(operator\.admin|admin\.operation|gateway\.control)" \
            "t:urlDecodeUni,t:lowercase"

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2026-22172?

CVE-2026-22172 is a Critical (9.9) vulnerability: OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-22172?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-22172?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

---

For authorized security testing and research only. See the full source and NVD record.