{"action":"Upgrade openclaw to 2026.2.22 or later.","affected":[{"fixed":"2026.2.22","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32062"],"ecosystem":"npm","epss":0.00438,"exploited":false,"fixed_versions":["2026.2.22"],"ghsa_id":"GHSA-mfg5-7q5g-f37j","id":"tcs_01M5KG0JFRKTSZVM7V9J8GEBWR","modified_at":"2026-09-10T03:50:39.974854950Z","published_at":"2026-03-02T22:39:43Z","references":["https://osv.dev/vulnerability/GHSA-mfg5-7q5g-f37j","https://github.com/openclaw/openclaw/security/advisories/GHSA-mfg5-7q5g-f37j","https://nvd.nist.gov/vuln/detail/CVE-2026-32062","https://github.com/openclaw/openclaw/commit/1d8968c8a821ff1a05c294a1846b3bcb6f343794","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-unauthenticated-websocket-resource-exhaustion-via-media-stream"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-mfg5-7q5g-f37j","url":"https://osv.dev/vulnerability/GHSA-mfg5-7q5g-f37j"}],"summary":"OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure"}